CVE-2019-25313: 
FlexNet Publisher vulnerability analysis and mitigation

CVE-2019-25313 is a Cross-Site Request Forgery (CSRF) vulnerability in FlexNet Publisher 11.12.1 that allows unauthenticated attackers to create administrative user accounts by tricking authenticated users into submitting a crafted malicious HTML form. The vulnerability was published on February 11, 2026, and affects FlexNet Publisher version 11.12.1. It carries a CVSS v3.1 base score of 4.0 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Feedly, CVE Feed).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), where the FlexNet Publisher 11.12.1 web interface fails to implement adequate anti-CSRF protections on administrative account creation endpoints. An attacker crafts a malicious HTML form that, when loaded by an authenticated administrator's browser, silently submits a forged HTTP request to create a new local admin account with a predefined password. Exploitation requires the victim to be an authenticated administrator who visits or is redirected to the attacker-controlled page. A technical write-up detailing the exploitation mechanics is publicly available (Infinitsec).

Successful exploitation allows an attacker to create a rogue administrative account with a known password on the FlexNet Publisher instance, effectively granting full unauthorized administrative control over the license management system. This can lead to privilege escalation, unauthorized modification of license configurations, and potential disruption of software licensing services across the organization. Since the attacker controls the credentials of the newly created admin account, persistent access and further lateral movement within the environment are plausible outcomes (Feedly).

A public technical write-up describing the exploitation of this vulnerability is available, indicating that proof-of-concept details are accessible to potential attackers (Infinitsec). The EPSS score is approximately 0.017%, suggesting a low but non-zero probability of exploitation in the wild. No evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog has been identified at this time (CVE Feed).

1. Reconnaissance: Identify a target running FlexNet Publisher 11.12.1 with an accessible web management interface, and identify an authenticated administrator who can be targeted via social engineering.
2. Craft malicious HTML form: Create an HTML page containing a hidden form that submits a POST request to the FlexNet Publisher admin account creation endpoint, pre-populating fields for a new admin username and a known attacker-controlled password.
3. Deliver the payload: Trick the authenticated administrator into visiting the attacker-controlled page via phishing email, malicious link, or injected content — the browser automatically submits the forged request using the victim's active session cookies.
4. Gain admin access: The FlexNet Publisher server processes the forged request as legitimate, creating a new local administrative account with the attacker's predefined credentials.
5. Achieve objective: The attacker logs into the FlexNet Publisher admin interface using the newly created account, gaining full administrative control over the license management system (Infinitsec).

• Logs: Unexpected administrative account creation events in FlexNet Publisher audit/access logs, particularly accounts created without a corresponding administrator-initiated action.
• Logs: HTTP POST requests to the admin account creation endpoint originating from unusual referrer URLs or external origins in web server access logs.
• Network: Outbound or cross-origin form submissions to the FlexNet Publisher management interface from unexpected source pages.
• Application: Presence of newly created local admin accounts with unfamiliar usernames or accounts created outside of normal change management windows in the FlexNet Publisher user management console (Infinitsec).

Organizations should apply any available patches or updates from Revenera (formerly Flexera) for FlexNet Publisher that address CSRF protections in the administrative interface. As an immediate workaround, restrict access to the FlexNet Publisher web management interface to trusted internal networks or VPN-only access to reduce the attack surface. Administrators should also enforce multi-factor authentication where supported, regularly audit admin accounts for unauthorized entries, and train users to be cautious of unsolicited links. Consult the Revenera/Flexera vendor advisory for official patch guidance (CVE Feed).

A technical blog post from Infinitsec provides a detailed breakdown of the vulnerability and its exploitation mechanics, indicating researcher interest in this issue (Infinitsec). No significant vendor statements, broader media coverage, or notable social media discussion has been identified for this CVE at this time.