---
id: CVE-2026-110390
title: FlexNet Beacon Missing Authentication Vulnerability
summary: >-
  Missing authentication in the FlexNet Beacon component of Flexera One and
  FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon
  policy and targeting information when anonymous web server access is enabled
  (the de…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-306
  - CWE-497
vendor: Flexera
product: FlexNet Beacon
affected:
  - flexnet_beacon < 26.4.1
  - flexnet_manager_suite >= 2026 R1 < 2026 R2
  - flexnet_manager_suite >= 2025 R2 < 2026 R1
  - flexnet_manager_suite >= 2025 R1 < 2025 R2
  - flexnet_manager_suite < 2025 R1
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:32:44.772Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110390'
references:
  - url: >-
      https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390
  - url: >-
      https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.942Z'
epss: 0.00408
epssPercentile: 0.35315
---

## Overview

Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).

## Affected

- `flexnet_beacon < 26.4.1`
- `flexnet_manager_suite >= 2026 R1 < 2026 R2`
- `flexnet_manager_suite >= 2025 R2 < 2026 R1`
- `flexnet_manager_suite >= 2025 R1 < 2025 R2`
- `flexnet_manager_suite < 2025 R1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.