This vulnerability (CVE-2026-9272) in Progress Software Flowmon ADS allows an authenticated low-privileged user to perform SQL Injection attacks by sending specially crafted requests. The flaw exists in versions before 12.5.6 and 13.0.5, enabling unauthorized data access and modification within the application. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation can lead to unauthorized access to sensitive application data and its modification by a low-privileged authenticated user. This compromises confidentiality, integrity, and availability of the affected system's data. The vulnerability could allow attackers to escalate privileges or manipulate data within the Flowmon ADS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Anomaly Detection System to trusted users only and monitor for suspicious activity involving low-privileged accounts. Avoid granting unnecessary privileges to users within Flowmon ADS.