Progress Software security advisories

54 advisories · 42 critical or high in 12 months · latest Sep 11

54 advisories

Date	Advisory	Severity	Fixed in
Sep 11	Progress Software Chef Automate: missing authentication Critical10.0Sep 11 CVE-2026-804624.13.520	Critical10.0	4.13.520
Sep 2	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Sep 2 CVE-2026-192192026.3.812	High8.1	2026.3.812
Sep 2	Progress Software Telerik UI for ASP.NET AJAX: path traversal High7.5Sep 2 CVE-2026-186722026.3.812	High7.5	2026.3.812
Aug 17	Progress Software ShareFile Storage Zones Controller: path traversal High7.2Aug 17 CVE-2026-16137No fix yet	High7.2	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: unsafe deserialization High8.0Aug 17 CVE-2026-16138No fix yet	High8.0	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: remote code execution High7.2Aug 17 CVE-2026-16139No fix yet	High7.2	No fix yet
Aug 12	Progress Software WhatsUp Gold: remote code execution High8.8Aug 12 CVE-2026-6594126.0.2	High8.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: cross-site scripting High8.0Aug 12 CVE-2026-6593726.0.2	High8.0	26.0.2
Aug 12	Progress Software WhatsUp Gold: improper authorization Medium4.3Aug 12 CVE-2026-6593826.0.2	Medium4.3	26.0.2
Aug 12	Progress Software WhatsUp Gold: path traversal Medium6.8Aug 12 CVE-2026-6593926.0.2	Medium6.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: insecure default permissions Medium6.8Aug 12 CVE-2026-6594026.0.2	Medium6.8	26.0.2
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.8Aug 5 CVE-2026-919211.3.6+1 more	Critical9.8	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-919311.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: cross-site scripting Critical9.3Aug 5 CVE-2026-919511.3.6+1 more	Critical9.3	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: server-side request forgery High8.5Aug 5 CVE-2026-920311.3.6+1 more	High8.5	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation High8.1Aug 5 CVE-2026-732711.3.6+1 more	High8.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-732911.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.1Aug 5 CVE-2026-755711.3.6+1 more	Critical9.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-870911.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: request smuggling Critical9.1Aug 5 CVE-2026-919011.3.6+1 more	Critical9.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: cross-site request forgery High7.5Aug 5 CVE-2026-732611.3.6+1 more	High7.5	11.3.6+1 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59687LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59688LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: improper authorization High8.0Jul 27 CVE-2026-59689LoadMaster 7.2.63.3+2 more	High8.0	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: missing authorization High8.0Jul 27 CVE-2026-59690LoadMaster 7.2.63.3+2 more	High8.0	LoadMaster 7.2.63.3+2 more
Jul 27	Progress Software ECS Connection Manager: command injection High8.4Jul 27 CVE-2026-59686LoadMaster 7.2.63.3+2 more	High8.4	LoadMaster 7.2.63.3+2 more
Jul 23	Progress Software MOVEit Transfer: cross-site scripting High7.1Jul 23 CVE-2026-159682025.1.5+1 more	High7.1	2025.1.5+1 more
Jul 23	Permissive cross-domain security policy with untrusted domains vulnerability in... High7.5Jul 23 CVE-2026-159662025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 23	Progress Software MOVEit Transfer: insufficient session expiration High7.5Jul 23 CVE-2026-159672025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 23	Progress Software MOVEit Transfer: improper authentication High7.5Jul 23 CVE-2026-106972025.1.5+1 more	High7.5	2025.1.5+1 more
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: denial of service Medium5.3Jul 22 CVE-2026-148652026.2.708	Medium5.3	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: hard-coded key Medium6.5Jul 22 CVE-2026-149322026.2.708	Medium6.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Jul 22 CVE-2026-131852026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: path traversal High8.1Jul 22 CVE-2026-131862026.2.708	High8.1	2026.2.708
Jul 22	In Progress Telerik UI for AJAX prior to v2026.2.708 High8.1Jul 22 CVE-2026-131872026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity check Medium5.9Jul 22 CVE-2026-131882026.2.708	Medium5.9	2026.2.708
Jul 22	Progress Software Telerik UI: attacker could influence server-side file path... High7.5Jul 22 CVE-2026-131892026.2.708	High7.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: unsafe deserialization High8.1Jul 22 CVE-2026-131902026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: server-side request forgery Medium6.5Jul 22 CVE-2026-131922026.2.708	Medium6.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: remote code execution High8.1Jul 22 CVE-2026-131812026.2.708	High8.1	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: information disclosure in errors High7.5Jul 22 CVE-2026-131822026.2.708	High7.5	2026.2.708
Jul 22	In Progress Telerik UI for AJAX prior to v2026.2.708 High7.5Jul 22 CVE-2026-131832026.2.708	High7.5	2026.2.708
Jul 22	Progress Software Telerik UI for ASP.NET AJAX: hard-coded key High7.5Jul 22 CVE-2026-131842026.2.708	High7.5	2026.2.708
Jul 21	Progress Software ShareFile Storage Zones Controller: path traversal High8.7Jul 21 CVE-2026-15724No fix yet	High8.7	No fix yet
Jul 8	Path equivalence: vulnerability in Progress MOVEit Transfer Low3.5Jul 8 CVE-2026-88012025.1.4+1 more	Low3.5	2025.1.4+1 more
Jul 8	Improper Neutralization of Special Elements in Data Query Logic vulnerability... Medium6.4Jul 8 CVE-2026-86492025.1.3+1 more	Medium6.4	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: path traversal Medium4.5Jul 8 CVE-2026-86502025.1.3+1 more	Medium4.5	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: authentication bypass Low3.7Jul 8 CVE-2026-86512025.1.3+1 more	Low3.7	2025.1.3+1 more
Jul 8	Progress Software MOVEit Transfer: improper authorization Low2.7Jul 8 CVE-2026-88002025.1.3+1 more	Low2.7	2025.1.3+1 more
Jul 8	Improper Neutralization of Special Elements in Data Query Logic vulnerability... High7.2Jul 8 CVE-2026-106982025.0.8+2 more	High7.2	2025.0.8+2 more
Jul 8	Progress Software MOVEit Transfer: memory leak High7.5Jul 8 CVE-2026-106992025.0.8+2 more	High7.5	2025.0.8+2 more
Jul 8	Progress Software MOVEit Transfer: cross-site scripting High8.0Jul 8 CVE-2026-119032026.0.1+2 more	High8.0	2026.0.1+2 more
Jul 2	Progress Software Flowmon: improper authorization High8.7Jul 2 CVE-2026-8079No fix yet	High8.7	No fix yet
Jul 2	Progress Software Flowmon ADS: SQL injection High8.7Jul 2 CVE-2026-9272No fix yet	High8.7	No fix yet

About Progress Software

Security advisories Progress Software publishes for its own products.

community.progress.com/s Progress Software

Progress Software elsewhere on fru.dev: Acquisitions · Quarterly · Paydays

Critical advisories by email