FlexNet Beacon security hotfix IOK-2107311

Flexera has identified a security vulnerability affecting certain FlexNet Beacon deployments that are configured to run a local web server. The Security Advisory related to this vulnerability can be found here: Security Advisory: FlexNet Beacon Security Update (CVE-2026-110390).

Fixed versions of the FlexNet Beacon component have been released for use with Flexera One and FlexNet Manager Suite to address this vulnerability.

This page provides information about:

• Affected versions
• Beacon web server configuration changes
• Installing and configuring fixed beacon versions
• What happens when a beacon is upgraded from an affected version to a fixed version?
• Configuring authenticated communications from child to parent beacons

Affected versions

The following beacon versions are affected by this vulnerability:

• Flexera One: Up to and including 26.4.0
• FlexNet Manager Suite: Up to and including 26.0.0 (2026 R1)

Beacon web server configuration changes

The fix for this vulnerability includes changes to the options available on the Local web server page in the beacon UI.

The new Enable the inventory-beacons endpoint option can be used to control whether the inventory-beacons endpoint is enabled in the web server. This option must be selected on any beacon that has a child beacon, and should be deselected on any beacon that does not need to support communications from child beacons. The default configuration is deselected.

The new Authentication option can have one of 3 values:

1. Allow anonymous access except to inventory-beacons (default): Allow anonymous access to /ManageSoftDL and /ManageSoftRL, and require authentication for /inventory-beacons. This is the typical option chosen for most beacons.
2. Allow anonymous access to all endpoints: Allow anonymous access to all three endpoints.
3. Require authentication for all endpoints: Require authentication for all endpoints used by agent and child beacon communications. Unauthenticated requests return an HTTP 401 Unauthorized response.

The following documentation pages contain more details about these options:

• For Flexera One beacons: Configuring Inventory Collection.
• For FlexNet Manager Suite beacons: Configuring Inventory Collection.

Installing and configuring fixed beacon versions

See below for details on how to obtain and install fixed versions of the FlexNet Beacon software component for Flexera One and FlexNet Manager Suite.

Flexera One beacons

Complete the following steps to update Beacons in Flexera One environments:

1. Fixed beacon versions are available from Flexera One, and can generally be obtained and deployed using your normal beacon deployment processes. Install beacon version 26.4.1 (or newer) to receive the hotfix for this vulnerability. General documentation covering approaches to upgrading Flexera One IT Asset Management beacons can be found here: Upgrading Inventory Beacons.
2. If the beacon has child beacons under it, follow guidance in the “Configuring authenticated communications from child to parent beacons” section below.

To verify the new beacon version has been installed successfully, run the beacon UI and check that the following options shown in the screenshot above appear on the Local web server page: Authentication, and Enable the inventory-beacons endpoint.

FlexNet Manager Suite beacons

Complete the following steps to install the hotfix for Beacons in FlexNet Manager Suite environments:

1. Download the hotfix package zip file from the Flexera Product and License Center that corresponds to the version of your Beacon. Hotfix files are named: BeaconHotfix-IOK-2107311-<version>.zip.
2. Close the Beacon user interface (if open).
3. Stop the FlexNet Beacon Engine service.
4. If the Beacon is configured to use IIS as the web server, stop IIS.
5. Make a backup copy of the following files that are under the beacon installation directory: C:\Program Files (x86)\Flexera Software\Inventory Beacon\DotNet\bin
   1. For beacon versions 2025 R2 (25.0) to 2026 R1 (26.0):
      1. Flexera.Beacon.Common.dll
      2. Flexera.Beacon.Deployment.dll
      3. Flexera.Beacon.HostIndependentWebService.dll
      4. Flexera.Beacon.IISWeb.dll
      5. Flexera.Common.WebService.dll
      6. InventoryBeacon.exe
   2. For beacon versions 2025 R1 (24.0) and older:
      1. Flexera.Beacon.Common.dll
      2. Flexera.Beacon.IISWeb.dll
      3. InventoryBeacon.exe
6. Replace the files with the new versions from the downloaded hotfix package zip file.
7. If IIS was stopped at step 4, restart IIS.
8. Restart the FlexNet Beacon Engine service.
9. If the beacon has child beacons under it, follow guidance in the “Configuring authenticated communications from child to parent beacons” section below.

To verify the update has been applied successfully, run the beacon UI and check that the following options shown in the screenshot above appear on the Local web server page: Authentication, and Enable the inventory-beacons endpoint.

IMPORTANT: If the beacon software is reinstalled or upgraded to a vulnerable version at any time after performing the above steps, these steps will need to be performed again to apply the hotfix to the new install.

NOTE: No Beacon installer is available for deployment of the hotfix via automated Beacon self-upgrade functionality for FlexNet Manager Suite beacons.

What happens when a beacon is upgraded from an affected version to a fixed version?

Beacons that do NOT have child beacons under them

There is no operational impact from this upgrade on beacons that do not have any child beacons under them.

Beacons that DO have child beacons under them

Because the new Enable the inventory-beacons endpoint option is disabled by default, when a parent beacon is upgraded from an affected version to a fixed version, child beacons will be unable to retrieve configuration details until action is taken.

See the following section “Configuring authenticated communications between child and parent beacons” for details about what action is required.

Configuring authenticated communications from child to parent beacons

When beacons are to be configured in a parent-child relationship, several steps must be performed for this configuration to be effective:

1. On the parent beacon that has just had the hotfix applied, select the following options on the Local web server page of the beacon UI:
   1. Enable the inventory-beacons endpoint: Enabled
   2. Authentication: Select an appropriate option; the option Allow anonymous access except to inventory-beacons is typical.
2. If the Beacon is configured to use IIS, apply configuration as described on the following page:
   • For Flexera One beacons: Restrict inventory-beacons access with IIS URL authorization.
   • For FlexNet Manager Suite beacons: Restrict inventory-beacons access with IIS URL authorization.

Where to get additional information

The following product documentation contains a list of recommendations for improving the security of your Beacons:

• For Flexera One beacons: Beacon Security Best Practices.
• For FlexNet Manager Suite beacons: Beacon Security Best Practices.

Contact Flexera Support with any questions you have about this hotfix. We are here to help.