This vulnerability (CVE-2026-4027) affects Flexera FlexNet Manager Suite versions 2025 R1 and R2 (versions >=2025.0.0 and <=2025.2.0). It is classified as CWE-284: Improper Access Control. The issue allows unauthorized access to attachment files due to insufficient access control mechanisms. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, high vulnerability confidentiality impact, and no impact on integrity or availability. The vendor has not provided an official fix or remediation guidance as of the published date.

The vulnerability could allow an attacker with network access and low privileges to access sensitive attachment files without authorization, potentially exposing confidential information. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should follow vendor communications closely. Until a patch is available, restrict network access to the affected systems and review access controls to minimize exposure to unauthorized users.