FlexNet Beacon Missing Authentication Vulnerability

published 2026-11-05 3 d ago modified 2026-11-05 3 d ago also EUVD-2026-117872

cvss: 6.9; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).

Patch / fix

fixed in 2 links 1

Flexera FlexNet Beacon 26.4.1
Flexera FlexNet Manager Suite 2025 R1, 2025 R1 IOK-2107311, 2025 R2, 2025 R2 IOK-2107311, 2026 R1, 2026 R1 IOK-2107311, 2026 R2

community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311 patch

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Flexera FlexNet Beacon
Flexera FlexNet Manager Suite

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

Sources

CVE List CVE-2026-110390
NVD CVE-2026-110390

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary