https://patchfirst.co/vendor/progress/New and newly exploited Progress Software CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-90868/CVE-2026-90868Thu, 29 Oct 2026 00:00:00 GMTProgress Software · WS_FTP Server. Not in CISA KEV. EPSS 1.5% (higher than 74.1% of CVEs). CVSS 9.9 CRITICAL. Priority 22.4 of 100.https://patchfirst.co/cve/CVE-2026-90866/CVE-2026-90866Thu, 29 Oct 2026 00:00:00 GMTProgress Software · WS_FTP Server. Not in CISA KEV. EPSS 0.7% (higher than 54.2% of CVEs). CVSS 9.1 CRITICAL. Priority 17.9 of 100.https://patchfirst.co/cve/CVE-2026-90863/CVE-2026-90863Thu, 29 Oct 2026 00:00:00 GMTProgress Software · WS_FTP Server. Not in CISA KEV. EPSS 0.7% (higher than 51.4% of CVEs). CVSS 9.1 CRITICAL. Priority 17.3 of 100.https://patchfirst.co/cve/CVE-2026-84295/CVE-2026-84295Thu, 29 Oct 2026 00:00:00 GMTProgress Software · WS_FTP Server. Not in CISA KEV. EPSS 0.6% (higher than 46.2% of CVEs). CVSS 10.0 CRITICAL. Priority 16.9 of 100.https://patchfirst.co/cve/CVE-2026-90864/CVE-2026-90864Thu, 29 Oct 2026 00:00:00 GMTProgress Software · WS_FTP Server. Not in CISA KEV. EPSS 0.5% (higher than 41.3% of CVEs). CVSS 9.1 CRITICAL. Priority 15.3 of 100.https://patchfirst.co/cve/CVE-2026-89068/CVE-2026-89068Wed, 14 Oct 2026 00:00:00 GMTProgress · MOVEit Transfer. Not in CISA KEV. EPSS 0.5% (higher than 45.2% of CVEs). CVSS 9.8 CRITICAL. Priority 18.1 of 100.https://patchfirst.co/cve/CVE-2026-89073/CVE-2026-89073Wed, 14 Oct 2026 00:00:00 GMTProgress · MOVEit Transfer. Not in CISA KEV. EPSS 0.4% (higher than 34.3% of CVEs). CVSS 9.8 CRITICAL. Priority 15.9 of 100.https://patchfirst.co/cve/CVE-2026-85955/CVE-2026-85955Mon, 12 Oct 2026 00:00:00 GMTProgress Software Corporation · MarkLogic Server. Not in CISA KEV. EPSS 0.6% (higher than 47.3% of CVEs). CVSS 9.9 CRITICAL. Priority 18.6 of 100.https://patchfirst.co/cve/CVE-2026-85948/CVE-2026-85948Mon, 12 Oct 2026 00:00:00 GMTProgress Software Corporation · MarkLogic Server. Not in CISA KEV. EPSS 0.4% (higher than 39% of CVEs). CVSS 9.9 CRITICAL. Priority 16.9 of 100.https://patchfirst.co/cve/CVE-2026-85947/CVE-2026-85947Mon, 12 Oct 2026 00:00:00 GMTProgress Software Corporation · MarkLogic Server. Not in CISA KEV. EPSS 0.4% (higher than 39% of CVEs). CVSS 9.9 CRITICAL. Priority 16.9 of 100.https://patchfirst.co/cve/CVE-2026-85956/CVE-2026-85956Mon, 12 Oct 2026 00:00:00 GMTProgress Software Corporation · MarkLogic Server. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.6 CRITICAL. Priority 15.7 of 100.https://patchfirst.co/cve/CVE-2026-9191/CVE-2026-9191Mon, 12 Oct 2026 00:00:00 GMTProgress Software Corporation · MarkLogic Server. Not in CISA KEV. EPSS 0.3% (higher than 20.1% of CVEs). CVSS 9.6 CRITICAL. Priority 12.9 of 100.https://patchfirst.co/cve/CVE-2026-91140/CVE-2026-91140Tue, 06 Oct 2026 00:00:00 GMTProgress Software · Autonomous REST Connector GenAI Agents. Not in CISA KEV. EPSS 2.0% (higher than 81.2% of CVEs). CVSS 9.6 CRITICAL. Priority 25.1 of 100.https://patchfirst.co/cve/CVE-2026-8037/CVE-2026-8037#kevFri, 07 Aug 2026 00:00:00 GMTProgress · LoadMaster. In CISA KEV since 2026-08-07. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-2699/CVE-2026-2699Thu, 02 Apr 2026 00:00:00 GMTProgress · ShareFile Storage Zones Controller. Not in CISA KEV. EPSS 58.4% (higher than 99.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 74.1 of 100.public-exploithttps://patchfirst.co/cve/CVE-2026-2701/CVE-2026-2701Thu, 02 Apr 2026 00:00:00 GMTProgress · ShareFile Storage Zones Controller. Not in CISA KEV. EPSS 54.5% (higher than 99.02% of CVEs). CVSS 9.1 CRITICAL. Priority 28.6 of 100.https://patchfirst.co/cve/CVE-2025-8868/CVE-2025-8868Mon, 29 Sep 2025 00:00:00 GMTProgress Software · Chef Automate. Not in CISA KEV. EPSS 25.9% (higher than 98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-4885/CVE-2024-4885#kevMon, 03 Mar 2025 00:00:00 GMTProgress · WhatsUp Gold. In CISA KEV since 2025-03-03. ENISA EUVD lists it as exploited. EPSS 99.3% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1068T1059https://patchfirst.co/cve/CVE-2024-1212/CVE-2024-1212#kevMon, 18 Nov 2024 00:00:00 GMTProgress · Kemp LoadMaster. In CISA KEV since 2024-11-18. ENISA EUVD lists it as exploited. EPSS 95.4% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1133T1059https://patchfirst.co/cve/CVE-2024-7679/CVE-2024-7679Wed, 25 Sep 2024 00:00:00 GMTProgress Software · Telerik UI for WinForms. Not in CISA KEV. EPSS 0.7% (higher than 54.7% of CVEs). CVSS 7.8 HIGH. Priority 51.4 of 100.https://patchfirst.co/cve/CVE-2024-7575/CVE-2024-7575Wed, 25 Sep 2024 00:00:00 GMTProgress Software · Telerik UI for WPF. Not in CISA KEV. EPSS 0.7% (higher than 53.3% of CVEs). CVSS 7.8 HIGH. Priority 51.1 of 100.https://patchfirst.co/cve/CVE-2024-7576/CVE-2024-7576Wed, 25 Sep 2024 00:00:00 GMTProgress Software · Telerik UI for WPF. Not in CISA KEV. EPSS 0.5% (higher than 40.1% of CVEs). CVSS 7.8 HIGH. Priority 48.5 of 100.https://patchfirst.co/cve/CVE-2024-8316/CVE-2024-8316Wed, 25 Sep 2024 00:00:00 GMTProgress Software · Telerik UI for WPF. Not in CISA KEV. EPSS 0.2% (higher than 15.9% of CVEs). CVSS 7.8 HIGH. Priority 43.6 of 100.https://patchfirst.co/cve/CVE-2024-6670/CVE-2024-6670#kevMon, 16 Sep 2024 00:00:00 GMTProgress · WhatsUp Gold. In CISA KEV since 2024-09-16, known ransomware use. ENISA EUVD lists it as exploited. EPSS 92.9% (higher than 99.83% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2024-6671/CVE-2024-6671Thu, 29 Aug 2024 00:00:00 GMTProgress Software Corporation · WhatsUp Gold. Not in CISA KEV. EPSS 19.0% (higher than 97.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.9 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-5806/CVE-2024-5806Tue, 25 Jun 2024 00:00:00 GMTProgress · MOVEit Transfer. Not in CISA KEV. EPSS 81.5% (higher than 99.64% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 68.6 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-4883/CVE-2024-4883Tue, 25 Jun 2024 00:00:00 GMTProgress Software Corporation · WhatsUp Gold. Not in CISA KEV. EPSS 64.5% (higher than 99.24% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 31.7 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-5010/CVE-2024-5010Tue, 25 Jun 2024 00:00:00 GMTProgress Software Corporation · WhatsUp Gold. Not in CISA KEV. EPSS 70.0% (higher than 99.37% of CVEs). CVSS 7.5 HIGH. Priority 25.1 of 100.https://patchfirst.co/cve/CVE-2024-4358/CVE-2024-4358#kevThu, 13 Jun 2024 00:00:00 GMTProgress · Telerik Report Server. In CISA KEV since 2024-06-13. ENISA EUVD lists it as exploited. EPSS 97.5% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 69.8 of 100.kevpublic-exploitT1190https://patchfirst.co/cve/CVE-2024-2389/CVE-2024-2389Tue, 02 Apr 2024 00:00:00 GMTProgress Software · Flowmon. Not in CISA KEV. EPSS 93.0% (higher than 99.83% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 67.0 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-2448/CVE-2024-2448Fri, 22 Mar 2024 00:00:00 GMTProgress Software · LoadMaster. Not in CISA KEV. EPSS 55.4% (higher than 99.03% of CVEs). CVSS 8.4 HIGH. Priority 25.7 of 100.https://patchfirst.co/cve/CVE-2023-40044/CVE-2023-40044#kevThu, 05 Oct 2023 00:00:00 GMTProgress · WS_FTP Server. In CISA KEV since 2023-10-05, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.4% (higher than 99.8% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1071.002 File Transfer Protocols; T1202 Indirect Command Execution. Priority 79.1 of 100.kevransomwarepublic-exploitT1059T1071.002T1202https://patchfirst.co/cve/CVE-2023-42657/CVE-2023-42657Wed, 27 Sep 2023 00:00:00 GMTProgress Software Corporation · WS_FTP Server. Not in CISA KEV. EPSS 16.0% (higher than 96.9% of CVEs). CVSS 9.9 CRITICAL. Priority 63.7 of 100.https://patchfirst.co/cve/CVE-2023-34362/CVE-2023-34362#kevFri, 02 Jun 2023 00:00:00 GMTProgress · MOVEit Transfer. In CISA KEV since 2023-06-02, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1082 System Information Discovery; T1105 Ingress Tool Transfer; T1136 Create Account; +1 more. Named in 2 threat reports. Priority 86.0 of 100.kevransomwarepublic-exploitT1190T1059T1005T1082T1105T1136T1531https://patchfirst.co/cve/CVE-2019-18935/CVE-2019-18935#kevWed, 03 Nov 2021 00:00:00 GMTProgress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1041T1496T1505.003https://patchfirst.co/cve/CVE-2017-9248/CVE-2017-9248#kevWed, 03 Nov 2021 00:00:00 GMTProgress · ASP.NET AJAX and Sitefinity. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.1% (higher than 99.51% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 69.8 of 100.kevpublic-exploitT1190T1552