Progress
Security incidents tagged Progress. Newest first.
- Incidents
- 6
- Live
- 0
- Patched
- 6
- Days without an incident
- 76
- Longest quiet run: 626 days (Nov 19–Aug 6)
Show 6 older incidents6 older incidents
August 2026 1
HighProgress LoadMaster: Progress LoadMaster Command Injection VulnerabilityPatched
Progress LoadMaster Patched
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Added to CISA KEV on 2026-08-07.
Open incident →CVE-2026-8037
August 2024 1
CriticalProgress WhatsUp Gold SQL InjectionPatched
Progress WhatsUp Gold Patched
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.
Open incident →CVE-2024-6670
May 2024 1
CriticalProgress Telerik Report Server Authentication Bypass by SpoofingPatched
Progress Telerik Report Server Patched
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.
Open incident →CVE-2024-4358
February 2024 1
CriticalProgress Kemp LoadMaster OS Command InjectionPatched
Progress Kemp LoadMaster Patched
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.
Open incident →CVE-2024-1212
October 2023 1
HighProgress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)Patched
Progress WS_FTP Server Patched
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.
Open incident →CVE-2023-40044
May 2023 1
- CriticalPatched
MOVEit Transfer zero-day: Cl0p mass data theft
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Progress MOVEit TransferClosed Jun 16, 2023
