{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:40:31.642Z",
  "tag": {
    "id": "progress",
    "label": "Progress",
    "isStack": false,
    "url": "https://pwn.watch/t/progress",
    "feed": "https://pwn.watch/t/progress/feed.xml"
  },
  "counts": {
    "incidents": 6,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 6
  },
  "incidents": [
    {
      "slug": "progress-loadmaster-cve-2026-8037",
      "title": "Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability",
      "url": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037",
      "json": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Progress LoadMaster",
      "tags": [
        "progress",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-8037"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-07",
      "closedAt": "2026-08-07",
      "updatedAt": "2026-08-07",
      "summary": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Added to CISA KEV on 2026-08-07.",
      "xPost": null
    },
    {
      "slug": "progress-whatsup-gold-cve-2024-6670",
      "title": "Progress WhatsUp Gold SQL Injection",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670",
      "json": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress WhatsUp Gold",
      "tags": [
        "progress",
        "whatsup-gold",
        "cisa-kev",
        "ransomware",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2024-6670"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-29",
      "closedAt": "2024-09-16",
      "updatedAt": "2024-09-16",
      "summary": "Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "progress-telerik-report-server-cve-2024-4358",
      "title": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358",
      "json": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress Telerik Report Server",
      "tags": [
        "dotnet",
        "progress",
        "telerik",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-4358"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-29",
      "closedAt": "2024-06-13",
      "updatedAt": "2024-06-13",
      "summary": "Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.",
      "xPost": null
    },
    {
      "slug": "progress-kemp-loadmaster-cve-2024-1212",
      "title": "Progress Kemp LoadMaster OS Command Injection",
      "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212",
      "json": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress Kemp LoadMaster",
      "tags": [
        "progress",
        "kemp-loadmaster",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-1212"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-21",
      "closedAt": "2024-11-18",
      "updatedAt": "2024-11-18",
      "summary": "Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.",
      "xPost": null
    },
    {
      "slug": "progress-ws-ftp-server-cve-2023-40044",
      "title": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)",
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044",
      "json": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Progress WS_FTP Server",
      "tags": [
        "progress",
        "ransomware",
        "cisa-kev",
        "deserialization"
      ],
      "cveIds": [
        "CVE-2023-40044"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-05",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "moveit-transfer-cl0p-mass-exploitation-2023",
      "title": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023",
      "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress MOVEit Transfer",
      "tags": [
        "progress",
        "moveit",
        "cl0p",
        "zero-day",
        "sql-injection",
        "data-breach",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-34362",
        "CVE-2023-35036",
        "CVE-2023-35708"
      ],
      "affectedVersions": [
        "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)",
        "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)",
        "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)"
      ],
      "fixedVersions": [
        "2021.0.8 (13.0.8)",
        "2021.1.6 (13.1.6)",
        "2022.0.6 (14.0.6)",
        "2022.1.7 (14.1.7)",
        "2023.0.3 (15.0.3)",
        "Older branches: see vendor advisory"
      ],
      "startedAt": "2023-05-27",
      "closedAt": "2023-06-16",
      "updatedAt": "2023-06-16",
      "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "progress-loadmaster-cve-2026-8037",
      "incidentTitle": "Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-07",
      "title": "CISA added CVE-2026-8037 to the KEV catalog (due 2026-08-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/progress-loadmaster-cve-2026-8037"
    },
    {
      "incident": "progress-kemp-loadmaster-cve-2024-1212",
      "incidentTitle": "Progress Kemp LoadMaster OS Command Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-18",
      "title": "CISA added CVE-2024-1212 to the KEV catalog (federal deadline 2024-12-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212"
    },
    {
      "incident": "progress-whatsup-gold-cve-2024-6670",
      "incidentTitle": "Progress WhatsUp Gold SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-16",
      "title": "CISA added CVE-2024-6670 to the KEV catalog (federal deadline 2024-10-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670"
    },
    {
      "incident": "progress-whatsup-gold-cve-2024-6670",
      "incidentTitle": "Progress WhatsUp Gold SQL Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-29",
      "title": "CVE-2024-6670 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670",
      "url": "https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670"
    },
    {
      "incident": "progress-telerik-report-server-cve-2024-4358",
      "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CISA added CVE-2024-4358 to the KEV catalog (federal deadline 2024-07-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358"
    },
    {
      "incident": "progress-telerik-report-server-cve-2024-4358",
      "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-29",
      "title": "CVE-2024-4358 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4358",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358"
    },
    {
      "incident": "progress-kemp-loadmaster-cve-2024-1212",
      "incidentTitle": "Progress Kemp LoadMaster OS Command Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-21",
      "title": "CVE-2024-1212 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1212",
      "url": "https://pwn.watch/i/progress-kemp-loadmaster-cve-2024-1212"
    },
    {
      "incident": "progress-ws-ftp-server-cve-2023-40044",
      "incidentTitle": "Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA added CVE-2023-40044 to the KEV catalog (due 2023-10-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2023-40044"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-09",
      "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-07",
      "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-02",
      "title": "CISA adds CVE-2023-34362 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-31",
      "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches",
      "body": null,
      "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-27",
      "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    }
  ]
}