Progress Software security advisories

Date	Advisory	Severity	Fixed in
Sep 11	Progress Software Chef Automate: missing authentication Critical10.0Sep 11 CVE-2026-804624.13.520	Critical10.0	4.13.520
Sep 2	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Sep 2 CVE-2026-192192026.3.812	High8.1	2026.3.812
Sep 2	Progress Software Telerik UI for ASP.NET AJAX: path traversal High7.5Sep 2 CVE-2026-186722026.3.812	High7.5	2026.3.812
Aug 17	Progress Software ShareFile Storage Zones Controller: path traversal High7.2Aug 17 CVE-2026-16137No fix yet	High7.2	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: unsafe deserialization High8.0Aug 17 CVE-2026-16138No fix yet	High8.0	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: remote code execution High7.2Aug 17 CVE-2026-16139No fix yet	High7.2	No fix yet
Aug 12	Progress Software WhatsUp Gold: remote code execution High8.8Aug 12 CVE-2026-6594126.0.2	High8.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: cross-site scripting High8.0Aug 12 CVE-2026-6593726.0.2	High8.0	26.0.2
Aug 12	Progress Software WhatsUp Gold: improper authorization Medium4.3Aug 12 CVE-2026-6593826.0.2	Medium4.3	26.0.2
Aug 12	Progress Software WhatsUp Gold: path traversal Medium6.8Aug 12 CVE-2026-6593926.0.2	Medium6.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: insecure default permissions Medium6.8Aug 12 CVE-2026-6594026.0.2	Medium6.8	26.0.2
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.8Aug 5 CVE-2026-919211.3.6+1 more	Critical9.8	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-919311.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: cross-site scripting Critical9.3Aug 5 CVE-2026-919511.3.6+1 more	Critical9.3	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: server-side request forgery High8.5Aug 5 CVE-2026-920311.3.6+1 more	High8.5	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation High8.1Aug 5 CVE-2026-732711.3.6+1 more	High8.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-732911.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.1Aug 5 CVE-2026-755711.3.6+1 more	Critical9.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-870911.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: request smuggling Critical9.1Aug 5 CVE-2026-919011.3.6+1 more	Critical9.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: cross-site request forgery High7.5Aug 5 CVE-2026-732611.3.6+1 more	High7.5	11.3.6+1 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59687LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59688LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: improper authorization High8.0Jul 27 CVE-2026-59689LoadMaster 7.2.63.3+2 more	High8.0	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: missing authorization High8.0Jul 27 CVE-2026-59690LoadMaster 7.2.63.3+2 more	High8.0	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59686LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 23	Progress Software MOVEit Transfer: cross-site scripting High7.1Jul 23 CVE-2026-159682025.1.5+1 more	High7.1	2025.1.5+1 more
Jul 23	Permissive cross-domain security policy with untrusted domains vulnerability in... High7.5Jul 23 CVE-2026-159662025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 23	Progress Software MOVEit Transfer: insufficient session expiration High7.5Jul 23 CVE-2026-159672025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 23	Progress Software MOVEit Transfer: improper authentication High7.5Jul 23 CVE-2026-106972025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: denial of service Medium5.3Jul 22 CVE-2026-148652026.2.708	Medium5.3	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: hard-coded key Medium6.5Jul 22 CVE-2026-149322026.2.708	Medium6.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Jul 22 CVE-2026-131852026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: path traversal High8.1Jul 22 CVE-2026-131862026.2.708	High8.1	2026.2.708
Jul 22	In Progress Telerik UI for AJAX prior to v2026.2.708 High8.1Jul 22 CVE-2026-131872026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity check Medium5.9Jul 22 CVE-2026-131882026.2.708	Medium5.9	2026.2.708
Jul 22	Progress Software Telerik UI: attacker could influence server-side file path... High7.5Jul 22 CVE-2026-131892026.2.708	High7.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: unsafe deserialization High8.1Jul 22 CVE-2026-131902026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: server-side request forgery Medium6.5Jul 22 CVE-2026-131922026.2.708	Medium6.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Jul 22 CVE-2026-131812026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: information disclosure in errors High7.5Jul 22 CVE-2026-131822026.2.708	High7.5	2026.2.708
Jul 22	In Progress Telerik UI for AJAX prior to v2026.2.708 High7.5Jul 22 CVE-2026-131832026.2.708	High7.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: hard-coded key High7.5Jul 22 CVE-2026-131842026.2.708	High7.5	2026.2.708
Jul 21	Progress Software ShareFile Storage Zones Controller: path traversal High8.7Jul 21 CVE-2026-15724No fix yet	High8.7	No fix yet
Jul 8	Path equivalence: vulnerability in Progress MOVEit Transfer Low3.5Jul 8 CVE-2026-88012025.1.4+1 more	Low3.5	2025.1.4+1 more
Jul 8	Improper Neutralization of Special Elements in Data Query Logic vulnerability... Medium6.4Jul 8 CVE-2026-86492025.1.3+1 more	Medium6.4	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: path traversal Medium4.5Jul 8 CVE-2026-86502025.1.3+1 more	Medium4.5	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: authentication bypass Low3.7Jul 8 CVE-2026-86512025.1.3+1 more	Low3.7	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: improper authorization Low2.7Jul 8 CVE-2026-88002025.1.3+1 more	Low2.7	2025.1.3+1 more
Jul 8	Improper Neutralization of Special Elements in Data Query Logic vulnerability... High7.2Jul 8 CVE-2026-106982025.0.8+2 more	High7.2	2025.0.8+2 more
Jul 8	Progress Software MOVEit Transfer: memory leak High7.5Jul 8 CVE-2026-106992025.0.8+2 more	High7.5	2025.0.8+2 more
Jul 8	Progress Software MOVEit Transfer: cross-site scripting High8.0Jul 8 CVE-2026-119032026.0.1+2 more	High8.0	2026.0.1+2 more
Jul 2	Progress Software Flowmon: improper authorization High8.7Jul 2 CVE-2026-8079No fix yet	High8.7	No fix yet
Jul 2	Progress Software Flowmon ADS: SQL injection High8.7Jul 2 CVE-2026-9272No fix yet	High8.7	No fix yet

About Progress Software

Progress Software Corporation is an American public company that produces software for creating and deploying business applications. It is founded in Burlington, Massachusetts, and has offices in 16 countries as of 2024.

Elsewhere on fru.dev: Acquisitions · Quarterly · Paydays

Critical advisories by email