Progress
Vulnerability activity for Progress: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.6CriticalAug 7, 2026Progress LoadMaster Code / command injectionCVE-2026-8037Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.Added to KEV Aug 7, 2026Exploited77% likelyExploit codeNucleiDetection
- 9.8CriticalJun 25, 2024Progress WhatsUp Gold Path traversal / file handlingCVE-2024-4885Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.Added to KEV Mar 3, 2025 · 250 days after publicationExploited99% likelyExploit codeNucleiDetection
- 10.0CriticalFeb 21, 2024Progress Kemp LoadMaster Code / command injectionCVE-2024-1212Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.Added to KEV Nov 18, 2024 · 270 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalAug 29, 2024Progress WhatsUp Gold SQL injectionCVE-2024-6670Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.Added to KEV Sep 16, 2024 · 17 days after publicationExploited93% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalMay 29, 2024Progress Telerik Report Server Auth bypass / access controlCVE-2024-4358Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.Added to KEV Jun 13, 2024 · 14 days after publicationExploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 10.0CriticalSep 27, 2023Progress WS FTP Server DeserializationCVE-2023-40044Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.Added to KEV Oct 5, 2023 · 7 days after publicationExploited90% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJun 2, 2023Progress moveit cloud SQL injectionCVE-2023-34362MOVEit Transfer web application prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1. An attacker gains unauthorized access to MOVEit Transfer's database. Update MOVEit Transfer to version 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, or 2023.0.1 or later.Added to KEV Jun 2, 2023 · same day as publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJul 3, 2017Progress ASP.NET AJAX and Sitefinity Crypto / certificateCVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.Added to KEV Nov 3, 2021 · 1,583 days after publicationExploited75% likelyExploit codeExploit-DB
- 9.8CriticalDec 11, 2019Progress Telerik UI for ASP.NET AJAX DeserializationCVE-2019-18935Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.Added to KEV Nov 3, 2021 · 693 days after publicationExploited100% likelyExploit codeExploit-DB · MetasploitDetection
Recent
- –UnscoredOct 16, 2026ProgressADV-cccs-0956fe3e25aaSerial Number: AV26-1058 Date: October 16, 2026 As of October 14, 2026, Progress is affected by vulnerabilities in the following product: MOVEit Transfer Prior to 2025.1.6 Prior to 2026.0.4 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. MOVEit Transfer Critical Security Bulletin - September 2026 Progress Trust Center
- 9.6CriticalAug 7, 2026Progress LoadMaster Code / command injectionCVE-2026-8037Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.Exploited77% likelyExploit codeNucleiDetection
- 8.7HighJul 21, 2026Progress sharefile storage zones controller Path traversal / file handlingCVE-2026-15724In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.
- 9.8CriticalJun 25, 2024Progress WhatsUp Gold Path traversal / file handlingCVE-2024-4885Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.Exploited99% likelyExploit codeNucleiDetection
- 10.0CriticalFeb 21, 2024Progress Kemp LoadMaster Code / command injectionCVE-2024-1212Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalAug 29, 2024Progress WhatsUp Gold SQL injectionCVE-2024-6670Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.Exploited93% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalMay 29, 2024Progress Telerik Report Server Auth bypass / access controlCVE-2024-4358Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.Exploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 10.0CriticalSep 27, 2023Progress WS FTP Server DeserializationCVE-2023-40044Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.Exploited90% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJun 2, 2023Progress moveit cloud SQL injectionCVE-2023-34362MOVEit Transfer web application prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1. An attacker gains unauthorized access to MOVEit Transfer's database. Update MOVEit Transfer to version 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, or 2023.0.1 or later.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalDec 11, 2019Progress Telerik UI for ASP.NET AJAX DeserializationCVE-2019-18935Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.Exploited100% likelyExploit codeExploit-DB · MetasploitDetection
- 9.8CriticalJul 3, 2017Progress ASP.NET AJAX and Sitefinity Crypto / certificateCVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.Exploited75% likelyExploit codeExploit-DB
Top products
- sharefile storage zones controller1 CVE in the last year
- LoadMaster1 CVE in the last year, 1 critical, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 16, 2026Progress security advisory (AV26-1058)ADV-cccs-0956fe3e25aa
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.