#NØØT_Security_Alerts 🚨 #ALERT — Flexera FlexNet Beacon May Disclose Internal Discovery Details Without Authentication November 4, 2026 PRODUCT: FlexNet Beacon | CVE-2026-110390 | MEDIUM (CVSS 4.0: 6.9). AFFECTED: Windows Inventory Beacons used with Flexera One ITAM/IT Visibility or FlexNet Manager Suite, where Beacon web services are reachable and anonymous access is enabled (the default). IMPACT: Unauthenticated access may expose discovery targets and, for ITAM/FNMS, inventory policies. Flexera states the flaw does not directly expose customer business data. No code execution is established. FIX: Flexera One Beacon ≤26.4.0: install 26.4.1+. For FNMS Beacon ≤26.0.0 (2026 R1), apply the IOK-2107311 hotfix matching the installed release. FNMS deployment requires manual file replacement; automatic Beacon self-upgrade does not install this hotfix. EXPLOITATION STATUS: Vendor-confirmed vulnerability; malicious exploitation not established. TRIAGE: Identify reachable Beacon web services. Review available IIS/local-server logs for unexpected /inventory-beacons requests. Requests alone do not prove information disclosure. URGENT ACTION: Preserve evidence, restrict unnecessary exposure, and apply the applicable fix with a service-restart plan. Updated parent Beacons disable /inventory-beacons by default. Where child Beacons depend on it, re-enable with appropriate authentication and IIS authorization, then verify synchronization. IMPORTANT: The patched default still allows anonymous access to /ManageSoftDL and /ManageSoftRL. Verify endpoint-specific access controls—not universal HTTP 401 responses. Confirm the installed hotfix and running configuration. SOURCE: https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390 https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110390.json CONFIDENCE: HIGH for the vendor-confirmed flaw, affected configurations and documented fixes. No verified victim compromise or data theft. #CyberSecurity #InfoSec #NetworkSecurity #CVE #VulnerabilityManagement #IncidentResponse #ThreatIntel