Flexera FlexNet Publisher: Remote code execution in lmadmin web interface
Summary
A remote code execution vulnerability exists in the lmadmin web user interface of FlexNet Publisher, licence-management software that runs on licence servers. An attacker with high privileges on the lmadmin interface can execute code on the server, with high impact on confidentiality, integrity and availability. The CVSS vector requires no user interaction, but the attacker needs administrative access to the interface, so exposure of the web UI determines the practical risk.
Affected
- FlexNet Publisher 2023 R1 (11.19.3.0) to before 2023 R2 (11.19.4.0)
- Versions older than 2023 R1: Unknown
- The CVE record names 'Revera FlexNet Publisher'; the vendor is Flexera (now Revenera)
- Products that bundle FlexNet Publisher, for example PTC Creo, Mathcad and Windchill, may be affected
Fixed in
- Upgrade to FlexNet Publisher 2023 R2 (11.19.4.0) or later
- Verify the current supported version on the Flexera knowledge base
Workaround
- No vendor workaround found.
- Until patched, restrict the lmadmin web UI to a management VLAN or VPN and block external access. This is an interim measure, not a vendor-confirmed fix.
Exploitation
- No confirmed exploitation in the wild found. PTC states it has no indication that the vulnerability is being exploited.
- VulDB reports no available exploit; this is a third-party statement.
- No public proof of concept found. EPSS: 0.38 %.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory all FlexNet Publisher and lmadmin instances, including those bundled with other software, and record their versions.
- Upgrade to 11.19.4.0 or later. Treat versions 11.19.3.0 or earlier, and unknown versions, as higher priority.
- Restrict the lmadmin web UI to internal management networks or VPN and block internet access.
- Review lmadmin logs for unexpected admin logins or unknown vendor daemons.
- Ask Flexera or the software vendor to confirm whether older versions are affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Flexera advisory: Remote code execution remediated in lmadmin community.flexera.com
- PTC support article cs394029 www.ptc.com
- NVD via Vulners vulners.com
- VulDB entry 428678 vuldb.com
- Revenera lmadmin licence server guide docs.revenera.com
- Strix CVE-2023-7357 tracker www.strix.ai
- CVE-2023-7357 threat intelligence record cve.threatint.com
- PSIRT CVE-2023-7357 psirt.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:45.
Original description (NVD)
A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.