{"id":"CVE-2026-110390","kind":"vulnerability","aliases":["CVE-2026-110390"],"related":[],"title":"Flexera FlexNet Beacon leaks policy and targeting data to unauthenticated users","description":"Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).","summary":"The FlexNet Beacon component of Flexera One and FlexNet Manager Suite lacks authentication on a web endpoint. An unauthenticated remote attacker can read Beacon policy and targeting information when anonymous web server access is enabled, which is the default.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flexera","flexnet-beacon","flexnet-manager-suite","infrastructure","software-asset-management"],"not_affected_if":["anonymous-access-disabled"],"how_to_check":"- Check whether anonymous web server access is enabled on the FlexNet Beacon component (the default is enabled, per the description).\n- Confirm which Flexera One or FlexNet Manager Suite deployments run a FlexNet Beacon component.\n- Version to compare against: unknown","fix":null,"status":"open","published_at":"2026-11-05T23:16:50+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:42+00:00","updated_at":"2026-11-05T23:49:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-05T23:49:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Flexera FlexNet Beacon leaks policy and targeting data to unauthenticated users","impact":"low","summary":"The FlexNet Beacon component of Flexera One and FlexNet Manager Suite lacks authentication on a web endpoint. An unauthenticated remote attacker can read Beacon policy and targeting information when anonymous web server access is enabled, which is the default.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["flexera","flexnet-manager-suite","flexnet-beacon","software-asset-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Beacon policy and targeting information is readable by anyone on the network","analyst_note":"Find the Flexera advisory for affected and fixed versions of FlexNet Beacon and confirm how the anonymous access setting is configured; the sources given do not state either.","how_to_check":"- Check whether anonymous web server access is enabled on the FlexNet Beacon component (the default is enabled, per the description).\n- Confirm which Flexera One or FlexNet Manager Suite deployments run a FlexNet Beacon component.\n- Version to compare against: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["anonymous-access-disabled"],"who_is_affected":"Organizations running FlexNet Beacon as part of Flexera One or FlexNet Manager Suite. The exposure depends on anonymous web server access being enabled on the Beacon, which is the default. Deployments that have disabled anonymous access are not exposed through this path. Affected versions and the vendor fix are not stated in the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4207,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110390':14A,17A '-2026':13A,16A 'access':63B,99C 'allow':84C 'anonym':60B,96C 'asset':29B 'attack':51B,87C 'authent':43B,71C 'beacon':3A,21B,33B,54B,75C,90C 'compon':34B,76C 'cve':12A,15A 'data':8A 'default':69B,103C 'enabl':65B,101C 'endpoint':47B 'flexera':1A,18B,36B,78C 'flexnet':2A,20B,23B,32B,39B,74C,81C 'flexnet-beacon':19B 'flexnet-manager-suit':22B 'inform':58B,94C 'infrastructur':26B 'lack':42B 'leak':4A 'manag':24B,30B,40B,82C 'miss':70C 'obtain':89C 'one':37B,79C 'polici':5A,55B,91C 'read':53B 'remot':50B,86C 'server':62B,98C 'softwar':28B 'software-asset-manag':27B 'suit':25B,41B,83C 'target':7A,57B,93C 'unauthent':10A,49B,85C 'user':11A 'web':46B,61B,97C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FlexNet Beacon as part of Flexera One or FlexNet Manager Suite. The exposure depends on anonymous web server access being enabled on the Beacon, which is the default. Deployments that have disabled anonymous access are not exposed through this path. Affected versions and the vendor fix are not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flexera","flexnetbeacon","flexnetmanagersuite","infrastructure","medium","softwareassetmanagement"],"campaign_type":null,"first_public_at":"2026-11-05T23:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"PSIRT-CNA@flexerasoftware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110390","severity":null,"published_at":"2026-11-05T23:16:50+00:00","modified_at":"2026-11-05T23:16:50+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}