Patchfirst
Patchfirst

Vendor

Progress Software

9 of 36 Progress Software CVEs in Patchfirst (25%) are in of vulnerabilities exploited in the wild, 4 of them used by ransomware.

CVEs
36
In CISA KEV
925%
Known ransomware use
4
Median days to KEV
64
from publication
Latest KEV listing
7 Aug 2026
Watch Progress Software Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • WhatsUp Gold In KEV: 2 CVEs: 5
  • WS_FTP Server In KEV: 1 CVEs: 7
  • MOVEit Transfer In KEV: 1 CVEs: 4
  • LoadMaster In KEV: 1 CVEs: 2
  • ASP.NET AJAX and Sitefinity In KEV: 1 CVEs: 1
  • Kemp LoadMaster In KEV: 1 CVEs: 1
  • Telerik Report Server In KEV: 1 CVEs: 1
  • Telerik UI for ASP.NET AJAX In KEV: 1 CVEs: 1
  • MarkLogic Server In KEV: 0 CVEs: 5
  • Telerik UI for WPF In KEV: 0 CVEs: 3

Top ATT&CK techniques

What attackers do with Progress Software CVEs
Open in ATT&CK Navigator

Counts are Progress Software CVEs linked to the technique. Each link’s provenance is on the CVE page.

Progress Software CVEs

36 CVEs, by priority
  1. CVE-2023-34362Progress MOVEit Transfer SQL Injection Vulnerability
    Progress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reports
    99.9%Top 0.03%
    86.0priority
  2. CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
    Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 1 report
    99.7%Top 0.05%
    83.7priority
  3. CVE-2024-6670Progress WhatsUp Gold SQL Injection Vulnerability
    Progress · WhatsUp GoldKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System
    92.9%Top 0.17%
    79.8priority
  4. CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
    Progress · WS_FTP ServerKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1202Indirect Command Execution+1 more
    90.4%Top 0.2%
    79.1priority
  5. CVE-2026-8037Progress LoadMaster Command Injection Vulnerability
    Progress · LoadMasterKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.8%Top 0.04%
    74.9priority
  6. CVE-2026-2699EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
    Progress · ShareFile Storage Zones ControllerPublic exploitCritical · 9.8
    58.4%Top 0.9%
    74.1priority
  7. CVE-2024-4885Progress WhatsUp Gold Path Traversal Vulnerability
    Progress · WhatsUp GoldKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1068Exploitation for Privilege Escalation
    99.3%Top 0.06%
    69.8priority
  8. CVE-2024-4358Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
    Progress · Telerik Report ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application
    97.5%Top 0.1%
    69.8priority
  9. CVE-2024-1212Progress Kemp LoadMaster OS Command Injection Vulnerability
    Progress · Kemp LoadMasterKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter
    95.4%Top 0.13%
    69.8priority
  10. CVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
    Progress · ASP.NET AJAX and SitefinityKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1552Unsecured Credentials
    75.1%Top 0.49%
    69.8priority
  11. CVE-2024-5806MOVEit Transfer Authentication Bypass Vulnerability
    Progress · MOVEit TransferPublic exploitCritical · 9.1
    81.5%Top 0.36%
    68.6priority
  12. CVE-2024-6671WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
    Progress Software Corporation · WhatsUp GoldPublic exploitCritical · 9.8
    19.0%Top 2.7%
    67.9priority
  13. CVE-2024-2389Flowmon Unauthenticated Command Injection Vulnerability
    Progress Software · FlowmonPublic exploitCritical · 10.0
    93.0%Top 0.17%
    67.0priority
  14. CVE-2025-8868Chef Automate compliance service SQL Injection Vulnerability
    Progress Software · Chef AutomatePublic exploitCritical · 9.8
    25.9%Top 2%
    66.5priority
  15. CVE-2023-42657WS_FTP Server Directory Traversal
    Progress Software Corporation · WS_FTP ServerCritical · 9.9
    16.0%Top 3.1%
    63.7priority
  16. CVE-2024-7679Improper neutralization special element in hyperlinks
    Progress Software · Telerik UI for WinFormsHigh · 7.8
    0.7%Top 45%
    51.4priority
  17. CVE-2024-7575Improper neutralization special element in hyperlinks
    Progress Software · Telerik UI for WPFHigh · 7.8
    0.7%Top 47%
    51.1priority
  18. CVE-2024-7576Progress UI for WPF format provider unsafe deserialization vulnerability
    Progress Software · Telerik UI for WPFHigh · 7.8
    0.5%Top 60%
    48.5priority
  19. CVE-2024-8316Progress UI for WPF format provider unsafe deserialization vulnerability
    Progress Software · Telerik UI for WPFHigh · 7.8
    0.2%Top 84%
    43.6priority
  20. CVE-2024-4883WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
    Progress Software Corporation · WhatsUp GoldPublic exploitCritical · 9.8
    64.5%Top 0.76%
    31.7priority
  21. CVE-2026-2701RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)
    Progress · ShareFile Storage Zones ControllerCritical · 9.1
    54.5%Top 0.99%
    28.6priority
  22. CVE-2024-2448LoadMaster Command Injection Vulnerability
    Progress Software · LoadMasterHigh · 8.4
    55.4%Top 0.97%
    25.7priority
  23. CVE-2026-91140An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software…
    Progress Software · Autonomous REST Connector GenAI AgentsCritical · 9.6
    2.0%Top 19%
    25.1priority
  24. CVE-2024-5010WhatsUp Gold TestController multiple information disclosure vulnerabilities
    Progress Software Corporation · WhatsUp GoldHigh · 7.5
    70.0%Top 0.63%
    25.1priority
  25. CVE-2026-90868An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…
    Progress Software · WS_FTP ServerCritical · 9.9
    1.5%Top 26%
    22.4priority
  26. CVE-2026-85955Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with…
    Progress Software Corporation · MarkLogic ServerCritical · 9.9
    0.6%Top 53%
    18.6priority
  27. CVE-2026-89068Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module)
    Progress · MOVEit TransferCritical · 9.8
    0.5%Top 55%
    18.1priority
  28. CVE-2026-90866A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.7%Top 46%
    17.9priority
  29. CVE-2026-90863Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.7%Top 49%
    17.3priority
  30. CVE-2026-84295Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…
    Progress Software · WS_FTP ServerCritical · 10.0
    0.6%Top 54%
    16.9priority
  31. CVE-2026-85948Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw…
    Progress Software Corporation · MarkLogic ServerCritical · 9.9
    0.4%Top 61%
    16.9priority
  32. CVE-2026-85947Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in…
    Progress Software Corporation · MarkLogic ServerCritical · 9.9
    0.4%Top 61%
    16.9priority
  33. CVE-2026-89073Insufficient Session Expiration vulnerability in Progress MOVEit Transfer
    Progress · MOVEit TransferCritical · 9.8
    0.4%Top 66%
    15.9priority
  34. CVE-2026-85956Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with…
    Progress Software Corporation · MarkLogic ServerCritical · 9.6
    0.4%Top 66%
    15.7priority
  35. CVE-2026-90864A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.5%Top 59%
    15.3priority
  36. CVE-2026-9191Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate…
    Progress Software Corporation · MarkLogic ServerCritical · 9.6
    0.3%Top 80%
    12.9priority
↑ ↓ chooseEnter openEsc close