Flexera FlexNet Publisher lmadmin: Authentication bypass in SOAP handler
Summary
FlexNet Publisher lmadmin, the license server administration component of Flexera's FlexNet Publisher, contains a SOAP handler with a hardcoded authentication bypass. An unauthenticated remote attacker can obtain a privileged administrator session without valid credentials. An attacker with such access could manipulate licensing policies and potentially disable license enforcement for software protected by FlexNet Publisher.
Affected
- Flexera FlexNet Publisher lmadmin versions 0 to and including 11.19.11 (per CVE record)
- Platforms according to third-party sources: Windows, Linux, macOS and Solaris
- Default configuration: unaffected according to the CVE record, meaning the affected range applies to the listed versions
Fixed in
- Conflicting information. A third-party mirror of the Revenera advisory names lmadmin 11.19.11.1 as fixed; HOL lists the fixed version as not reported.
- Not verified against the vendor advisory. Confirm the fixed build on the Revenera advisory and download page before patching.
Workaround
- No vendor workaround found in the sources reviewed.
- Generic third-party recommendation: until patching is possible, restrict access to the lmadmin service ports to trusted management subnets using firewall rules or access control lists.
- Unknown: which ports lmadmin uses in your environment; verify your own configuration.
Exploitation
- Not known exploited. No CISA KEV listing reported by the sources reviewed.
- No public proof of concept found; VulDB states no exploit is available.
- VulDB analysis predicts automatable exploitation, but this is a prediction, not reported activity.
- EPSS: 0.00372.
Our recommendation
- Check whether FlexNet Publisher or lmadmin is installed and which version is in use, including at customers.
- Check whether lmadmin is reachable from the internet, guest networks or the wider LAN, and restrict access to trusted admin subnets now.
- Patch once the fixed build is confirmed on the Revenera advisory.
- Review logs on the license server for unexpected administrator sessions.
- Priority is high where lmadmin is reachable from untrusted networks, lower if restricted to an admin subnet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Revenera advisory (not retrieved, verify) community.revenera.com
- OpenCVE CVE record mirror app.opencve.io
- VulDB CVE entry vuldb.com
- VulDB exploit status vuldb.com
- HOL CVE entry hol.org
- Fixed-version mirror (third party) cve.imfht.com
- Vulners VulnRichment vulners.com
- Strix CVE record www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:11.
Original description (NVD)
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.