CVE-2026-110390 · Infrastructure
NO FIX YET
The FlexNet Beacon component of Flexera One and FlexNet Manager Suite lacks authentication on a web endpoint. An unauthenticated remote attacker can read Beacon policy and targeting information when anonymous web server access is enabled, which is the default.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running FlexNet Beacon as part of Flexera One or FlexNet Manager Suite. The exposure depends on anonymous web server access being enabled on the Beacon, which is the default. Deployments that have disabled anonymous access are not exposed through this path. Affected versions and the vendor fix are not stated in the sources.
Not affected if anonymous-access-disabled
Who cares flexera, flexnet-beacon, flexnet-manager-suite, software-asset-management
No fix yet, per the sources.
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.