Vulnerabilities by vendor · updated on every deploy
Progress vulnerabilities: exploited CVEs and our analysis
Progress has 9 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 1 of them added in the last 12 months and 4 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on Progress products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
9
CVEs in CISA KEV
1
Added in the last 12 months
4
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: WhatsUp Gold (2) · ASP.NET AJAX and Sitefinity (1) · Kemp LoadMaster (1) · LoadMaster (1) · MOVEit Transfer (1) · Telerik Report Server (1)
Our analysis of Progress vulnerabilities
2026-08-14
Progress LoadMaster CVE-2026-8037: A Pre-Auth RCE in the Load BalancerCVE-2026-8037 is an unauthenticated command injection in Progress Kemp LoadMaster — patched in June, on CISA KEV by August 7 after 792 exploit attempts. What the escape_quotes() bug does and how to remediate it.
All 9 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-08-07 | CVE-2026-8037 | LoadMaster Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command end… | 2026-08-10 | Forensic triage | Read → |
| 2025-03-03 | CVE-2024-4885 | WhatsUp Gold Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. | 2025-03-24 | — | |
| 2024-11-18 | CVE-2024-1212 | Kemp LoadMaster Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system comma… | 2024-12-09 | — | |
| 2024-09-16 | CVE-2024-6670 | WhatsUp Gold Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. | 2024-10-07 | Ransomware | — |
| 2024-06-13 | CVE-2024-4358 | Telerik Report Server Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. | 2024-07-04 | — | |
| 2023-10-05 | CVE-2023-40044 | WS_FTP Server Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. | 2023-10-26 | Ransomware | — |
| 2023-06-02 | CVE-2023-34362 | MOVEit Transfer Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQ… | 2023-06-23 | Ransomware | — |
| 2021-11-03 | CVE-2019-18935 | Telerik UI for ASP.NET AJAX Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2017-9248 | ASP.NET AJAX and Sitefinity Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the Machin… | 2022-05-03 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Progress vulnerabilities are in the CISA KEV catalog?
9 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-08-07. 1 were added in the last 12 months.
Which Progress products have the most exploited vulnerabilities?
By KEV entries: WhatsUp Gold (2), ASP.NET AJAX and Sitefinity (1), Kemp LoadMaster (1), LoadMaster (1), MOVEit Transfer (1), Telerik Report Server (1).
Are Progress vulnerabilities used in ransomware attacks?
CISA marks 4 of the 9 Progress entries as known to be used in ransomware campaigns. The table flags them.
Is the next Progress CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · F5