Progress Software security advisories

56 advisories · 43 critical or high in 12 months · latest Sep 29

56 advisories

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere...CVE-2026-86157fixed in 8.2.0 High 7.7Sep 29

Progress Telerik Fiddler Everywhere: missing authenticationCVE-2026-86158fixed in 8.2.0 Critical 10.0Sep 11

Progress Software Chef Automate: missing authenticationCVE-2026-80462fixed in 4.13.520 High 8.1Sep 2

Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-19219fixed in 2026.3.812 High 7.5Sep 2

Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-18672fixed in 2026.3.812 High 7.2Aug 17

Progress Software ShareFile Storage Zones Controller: path traversalCVE-2026-16137no fix yet High 8.0Aug 17

Progress Software ShareFile Storage Zones Controller: unsafe deserializationCVE-2026-16138no fix yet High 7.2Aug 17

Progress Software ShareFile Storage Zones Controller: remote code executionCVE-2026-16139no fix yet Critical 9.8Aug 12

Progress Software WhatsUp Gold: remote code executionCVE-2026-65941fixed in 26.0.2 High 8.0Aug 12

Progress Software WhatsUp Gold: cross-site scriptingCVE-2026-65937fixed in 26.0.2 Medium 4.3Aug 12

Progress Software WhatsUp Gold: improper authorizationCVE-2026-65938fixed in 26.0.2 Medium 6.8Aug 12

Progress Software WhatsUp Gold: path traversalCVE-2026-65939fixed in 26.0.2 Medium 6.8Aug 12

Progress Software WhatsUp Gold: insecure default permissionsCVE-2026-65940fixed in 26.0.2 Critical 9.8Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-9192fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-9193fixed in 11.3.6 +1 Critical 9.3Aug 5

Progress Software MarkLogic Server: cross-site scriptingCVE-2026-9195fixed in 11.3.6 +1 High 8.5Aug 5

Progress Software MarkLogic Server: server-side request forgeryCVE-2026-9203fixed in 11.3.6 +1 High 8.1Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7327fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7329fixed in 11.3.6 +1 Critical 9.1Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-7557fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-8709fixed in 11.3.6 +1 Critical 9.1Aug 5

Progress Software MarkLogic Server: request smugglingCVE-2026-9190fixed in 11.3.6 +1 High 7.5Aug 5

Progress Software MarkLogic Server: cross-site request forgeryCVE-2026-7326fixed in 11.3.6 +1 High 8.4Jul 27

Progress Software ECS Connection Manager: command injectionCVE-2026-59687fixed in LoadMaster 7.2.63.3 +2 High 8.4Jul 27

Progress Software ECS Connection Manager: command injectionCVE-2026-59688fixed in LoadMaster 7.2.63.3 +2 High 8.0Jul 27

Progress Software ECS Connection Manager: improper authorizationCVE-2026-59689fixed in LoadMaster 7.2.63.3 +2 High 8.0Jul 27

Progress Software ECS Connection Manager: missing authorizationCVE-2026-59690fixed in LoadMaster 7.2.63.3 +2 High 8.4Jul 27

Progress Software ECS Connection Manager: command injectionCVE-2026-59686fixed in LoadMaster 7.2.63.3 +2 High 7.1Jul 23

Progress Software MOVEit Transfer: cross-site scriptingCVE-2026-15968fixed in 2025.1.5 +1 High 7.5Jul 23

Permissive cross-domain security policy with untrusted domains vulnerability in...CVE-2026-15966fixed in 2025.1.5 +1 High 7.5Jul 23

Progress Software MOVEit Transfer: insufficient session expirationCVE-2026-15967fixed in 2025.1.5 +1 High 7.5Jul 23

Progress Software MOVEit Transfer: improper authenticationCVE-2026-10697fixed in 2025.1.5 +1 Medium 5.3Jul 22

Progress Software Telerik UI for ASP.NET AJAX: denial of serviceCVE-2026-14865fixed in 2026.2.708 Medium 6.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: hard-coded keyCVE-2026-14932fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13185fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-13186fixed in 2026.2.708 High 8.1Jul 22

In Progress Telerik UI for AJAX prior to v2026.2.708CVE-2026-13187fixed in 2026.2.708 Medium 5.9Jul 22

Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity checkCVE-2026-13188fixed in 2026.2.708 High 7.5Jul 22

Progress Software Telerik UI: attacker could influence server-side file path...CVE-2026-13189fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: unsafe deserializationCVE-2026-13190fixed in 2026.2.708 Medium 6.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: server-side request forgeryCVE-2026-13192fixed in 2026.2.708 High 8.1Jul 22

Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13181fixed in 2026.2.708 High 7.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: information disclosure in errorsCVE-2026-13182fixed in 2026.2.708 High 7.5Jul 22

In Progress Telerik UI for AJAX prior to v2026.2.708CVE-2026-13183fixed in 2026.2.708 High 7.5Jul 22

Progress Software Telerik UI for ASP.NET AJAX: hard-coded keyCVE-2026-13184fixed in 2026.2.708 High 8.7Jul 21

Progress Software ShareFile Storage Zones Controller: path traversalCVE-2026-15724no fix yet Low 3.5Jul 8

Path equivalence: vulnerability in Progress MOVEit TransferCVE-2026-8801fixed in 2025.1.4 +1 Medium 6.4Jul 8

Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-8649fixed in 2025.1.3 +1 Medium 4.5Jul 8

Progress Software MOVEit Transfer: path traversalCVE-2026-8650fixed in 2025.1.3 +1 Low 3.7Jul 8

Progress Software MOVEit Transfer: authentication bypassCVE-2026-8651fixed in 2025.1.3 +1 Low 2.7Jul 8

Progress Software MOVEit Transfer: improper authorizationCVE-2026-8800fixed in 2025.1.3 +1 High 7.2Jul 8

Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-10698fixed in 2025.0.8 +2 High 7.5Jul 8

Progress Software MOVEit Transfer: memory leakCVE-2026-10699fixed in 2025.0.8 +2 High 8.0Jul 8

Progress Software MOVEit Transfer: cross-site scriptingCVE-2026-11903fixed in 2026.0.1 +2 High 8.7Jul 2

Progress Software Flowmon: improper authorizationCVE-2026-8079no fix yet High 8.7Jul 2

Progress Software Flowmon ADS: SQL injectionCVE-2026-9272no fix yet

About Progress Software

Security advisories Progress Software publishes for its own products.

community.progress.com/s Progress Software

Progress Software elsewhere on Ibis: Acquisitions · Quarterly · Paydays