Exploited vulnerabilities
Progress
9 Progress vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue9
Last 12 months1
In ransomware campaigns4
Last addition7 August 2026
The vulnerabilities9
- 7 August 2026CVE-2026-8037LoadMasterProgress LoadMaster Command Injection Vulnerability
- 3 March 2025CVE-2024-4885WhatsUp GoldProgress WhatsUp Gold Path Traversal Vulnerability
- 18 November 2024CVE-2024-1212Kemp LoadMasterProgress Kemp LoadMaster OS Command Injection Vulnerability
- 16 September 2024CVE-2024-6670WhatsUp GoldProgress WhatsUp Gold SQL Injection VulnerabilityRansomware
- 13 June 2024CVE-2024-4358Telerik Report ServerProgress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
- 5 October 2023CVE-2023-40044WS_FTP ServerProgress WS_FTP Server Deserialization of Untrusted Data VulnerabilityRansomware
- 2 June 2023CVE-2023-34362MOVEit TransferProgress MOVEit Transfer SQL Injection VulnerabilityRansomware
- 3 November 2021CVE-2019-18935Telerik UI for ASP.NET AJAXProgress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data VulnerabilityRansomware
- 3 November 2021CVE-2017-9248ASP.NET AJAX and SitefinityProgress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, Progress included.