CVE-2026-19572 Overview
CVE-2026-19572 is an authentication bypass vulnerability in the Revenera FlexNet Publisher lmadmin license server. The flaw resides in a Simple Object Access Protocol (SOAP) handler that contains hardcoded credentials [CWE-288]. An unauthenticated remote attacker can send a crafted SOAP request to obtain a privileged administrator session without supplying valid credentials. Successful exploitation grants full administrative control over the license management service.
Critical Impact
Remote attackers can gain administrator-level access to FlexNet Publisher lmadmin over the network with no authentication, no user interaction, and low attack complexity.
Affected Products
- Revenera FlexNet Publisher lmadmin license server
- Deployments exposing the lmadmin SOAP interface on the network
- Applications licensed through FlexNet Publisher that bundle the vulnerable lmadmin component
Discovery Timeline
- 2026-10-07 - CVE-2026-19572 published to the National Vulnerability Database
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-19572
Vulnerability Analysis
FlexNet Publisher lmadmin exposes a web-based administration interface backed by SOAP handlers for programmatic management. One of these SOAP handlers contains hardcoded authentication logic that treats a specific request as pre-authenticated. When the handler receives a matching request, it issues a valid administrator session token to the caller.
An attacker with network access to the lmadmin service can invoke the SOAP endpoint directly and bypass the standard login workflow. Because the resulting session is indistinguishable from a legitimate administrator session, the attacker inherits full privileges over license configuration, vendor daemon control, and server state. The weakness is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel.
Root Cause
The root cause is a hardcoded credential or static authentication check inside a SOAP handler. The handler accepts a known value in place of a validated session, bypassing the credential verification applied to the normal web UI. Hardcoded authentication artifacts cannot be rotated by operators and remain valid on every deployment running the affected code.
Attack Vector
Exploitation requires only network reachability to the lmadmin HTTP listener. The attacker crafts a SOAP request to the vulnerable handler and receives an administrator session identifier in response. No prior credentials, phishing, or user interaction are required. See the Revenera Security Advisory for CVE-2026-19572 for vendor-provided technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-19572
Indicators of Compromise
- Unexpected SOAP POST requests to the lmadmin administration port from external or non-administrative source addresses.
- Administrator session cookies issued without a preceding successful login event in lmadmin logs.
- Configuration changes to vendor daemons, license files, or server options with no corresponding authenticated admin activity.
- New or modified reservation rules, option files, or shutdown events outside maintenance windows.
Detection Strategies
- Inspect HTTP access logs for SOAP endpoint URIs on the lmadmin listener and correlate against the authenticated user population.
- Alert on administrator actions in lmadmin audit logs that lack a matching authentication event.
- Baseline normal SOAP traffic volume to lmadmin and flag deviations from known management hosts.
Monitoring Recommendations
- Forward lmadmin web and audit logs to a central logging platform for retention and correlation.
- Monitor outbound connections from license servers for signs of post-exploitation activity such as reverse shells or data staging.
- Track process execution on hosts running lmadmin to detect spawning of shells or administrative utilities from the service account.
How to Mitigate CVE-2026-19572
Immediate Actions Required
- Restrict network access to the lmadmin administration port to trusted management subnets using host and network firewalls.
- Review lmadmin audit logs for unauthorized administrator sessions and configuration changes since the service was first exposed.
- Rotate any secrets, license keys, or credentials that may have been visible to a compromised lmadmin instance.
Patch Information
Refer to the Revenera Security Advisory for CVE-2026-19572 for the fixed lmadmin version and upgrade instructions. Application vendors that redistribute FlexNet Publisher should obtain the updated component from Revenera and re-release licensed products with the patched lmadmin binary.
Workarounds
- Block external access to the lmadmin HTTP interface at the perimeter until the patched version is deployed.
- Place lmadmin behind a reverse proxy that enforces source IP allowlists and TLS client authentication.
- Disable or firewall off the SOAP endpoint if the deployment does not require programmatic administration.
- Isolate license servers on a dedicated management VLAN with no direct access from user workstations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
