{"meta":{"title":"KEV entries: Progress","description":"All KEV entries for vendor Progress.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":9,"vendor":"Progress","entries":9,"shareOfCatalogPercent":0.5,"ransomwareKnown":4,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-08-07","rank":29},"data":[{"cveID":"CVE-2026-8037","vendorProject":"Progress","product":"LoadMaster","vulnerabilityName":"Progress LoadMaster Command Injection Vulnerability","dateAdded":"2026-08-07","dueDate":"2026-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-8037","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-8037/"},{"cveID":"CVE-2024-4885","vendorProject":"Progress","product":"WhatsUp Gold","vulnerabilityName":"Progress WhatsUp Gold Path Traversal Vulnerability","dateAdded":"2025-03-03","dueDate":"2025-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-4885","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-4885"},{"cveID":"CVE-2024-1212","vendorProject":"Progress","product":"Kemp LoadMaster","vulnerabilityName":"Progress Kemp LoadMaster OS Command Injection Vulnerability","dateAdded":"2024-11-18","dueDate":"2024-12-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1212","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-1212"},{"cveID":"CVE-2024-6670","vendorProject":"Progress","product":"WhatsUp Gold","vulnerabilityName":"Progress WhatsUp Gold SQL Injection Vulnerability","dateAdded":"2024-09-16","dueDate":"2024-10-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-6670","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-6670"},{"cveID":"CVE-2024-4358","vendorProject":"Progress","product":"Telerik Report Server","vulnerabilityName":"Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability","dateAdded":"2024-06-13","dueDate":"2024-07-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-290"],"shortDescription":"Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358; https://nvd.nist.gov/vuln/detail/CVE-2024-4358","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-4358"},{"cveID":"CVE-2023-40044","vendorProject":"Progress","product":"WS_FTP Server","vulnerabilityName":"Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-10-05","dueDate":"2023-10-26","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://nvd.nist.gov/vuln/detail/CVE-2023-40044","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-40044"},{"cveID":"CVE-2023-34362","vendorProject":"Progress","product":"MOVEit Transfer","vulnerabilityName":"Progress MOVEit Transfer SQL Injection Vulnerability","dateAdded":"2023-06-02","dueDate":"2023-06-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.","requiredAction":"Apply updates per vendor instructions.","notes":"This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.;  https://nvd.nist.gov/vuln/detail/CVE-2023-34362","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-34362"},{"cveID":"CVE-2019-18935","vendorProject":"Progress","product":"Telerik UI for ASP.NET AJAX","vulnerabilityName":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-18935","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-18935"},{"cveID":"CVE-2017-9248","vendorProject":"Progress","product":"ASP.NET AJAX and Sitefinity","vulnerabilityName":"Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-522"],"shortDescription":"Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9248","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-9248"}]}