CVE-2026-19572: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Flexera FlexNet Publisher

This vulnerability in FlexNet Publisher lmadmin is due to a hardcoded authentication bypass in a SOAP handler, classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). An unauthenticated attacker can leverage this flaw to obtain privileged administrator access without valid credentials. The affected versions range from 0 through 11.19.11. The CVSS 4.0 score of 9.3 reflects network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to gain privileged administrator sessions, potentially leading to full control over the affected FlexNet Publisher instance. This can compromise confidentiality, integrity, and availability of the system managed by lmadmin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the lmadmin SOAP interface to trusted administrators only and monitor for suspicious activity.