pwn.watch: Progress incident updates

[high] Progress LoadMaster: Progress LoadMaster Command Injection Vulnerability

Fri, 07 Aug 2026 00:00:00 GMT

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Added to CISA KEV on 2026-08-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-07: CISA added CVE-2026-8037 to the KEV catalog (due 2026-08-10).

CVEs: CVE-2026-8037

[critical] Progress Kemp LoadMaster OS Command Injection

Mon, 18 Nov 2024 00:00:00 GMT

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-18: CISA added CVE-2024-1212 to the KEV catalog (federal deadline 2024-12-09) (source)
2024-02-21: CVE-2024-1212 published (source)

CVEs: CVE-2024-1212

[critical] Progress WhatsUp Gold SQL Injection

Mon, 16 Sep 2024 00:00:00 GMT

Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-16: CISA added CVE-2024-6670 to the KEV catalog (federal deadline 2024-10-07) (source)
2024-08-29: CVE-2024-6670 published (source)

CVEs: CVE-2024-6670

[critical] Progress Telerik Report Server Authentication Bypass by Spoofing

Thu, 13 Jun 2024 00:00:00 GMT

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-06-13: CISA added CVE-2024-4358 to the KEV catalog (federal deadline 2024-07-04) (source)
2024-05-29: CVE-2024-4358 published (source)

CVEs: CVE-2024-4358

[high] Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)

Thu, 05 Oct 2023 00:00:00 GMT

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-05: CISA added CVE-2023-40044 to the KEV catalog (due 2023-10-26).

CVEs: CVE-2023-40044

[critical] MOVEit Transfer zero-day: Cl0p mass data theft

Fri, 16 Jun 2023 00:00:00 GMT

Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.

Status: closed · Patch: patched · Fixed in: 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), Older branches: see vendor advisory

Latest updates:

2023-06-16: Third round of fixes for CVE-2023-35708 after a public proof of concept (source)
2023-06-09: Progress fixes more SQL injection bugs found during code review (CVE-2023-35036) (source)
2023-06-07: CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505) (source)

CVEs: CVE-2023-34362, CVE-2023-35036, CVE-2023-35708