CVE-2026-19572 – Flexera FlexNet Publisher

This FlexNet Publisher update closes a critical authentication bypass in the lmadmin license server. CVE-2026-19572 has a CVSS score of 9.3, Critical severity. The flaw sits in a SOAP handler that contains a hardcoded authentication bypass. An unauthenticated attacker can use it to get a privileged administrator session without valid credentials.

Administrator control of lmadmin gives an attacker command of license management, so they can disrupt access to licensed software across the organization. The update removes the bypass and restores proper authentication on the SOAP interface. Patch every exposed lmadmin instance on a same-day timeline.