What is CVE-2025-11906?

CVE-2025-11906 is a medium-severity vulnerability in Progress Software Flowmon, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.7/10. Published 2025-10-30.

How severe is CVE-2025-11906?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Vulnerability in Progress Software Flowmon

CVE-2025-11906

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.

EPSS: 0.001 (2.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Progress Software Flowmon — versions Flowmon 12 versions prior to 12.5.6

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

security@progress.com (vendor-advisory)

Frequently asked questions

What is CVE-2025-11906?: CVE-2025-11906 is a medium-severity vulnerability in Progress Software Flowmon, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.7/10. Published 2025-10-30.
How severe is CVE-2025-11906?: Medium severity. CVSS v3 base score is 6.7 out of 10.