Progress flaws being used in attacks
CISA lists 9 flaws in Progress products as being used in attacks, most recently on 7 Aug 2026. 4 have been used in ransomware.
ProgressBeing used in attacks
- On CISA’s list
- 9 flaws, added between 3 Nov 2021 and 7 Aug 2026
- Most recent
- CVE-2026-8037, Progress LoadMaster Command Injection Vulnerability, added 7 Aug 2026
- Used in ransomware
- 4 flaws, according to CISA
- Products
- WhatsUp Gold (2), ASP.NET AJAX and Sitefinity (1), Kemp LoadMaster (1), LoadMaster (1), MOVEit Transfer (1), and 3 more
What to do
- Update every Progress product you use.Install the updates Progress offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Progress LoadMaster
CVE-2026-8037Progress LoadMaster Command Injection VulnerabilityProgress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Progress WhatsUp Gold
CVE-2024-4885Progress WhatsUp Gold Path Traversal VulnerabilityProgress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Progress Kemp LoadMaster
CVE-2024-1212Progress Kemp LoadMaster OS Command Injection VulnerabilityProgress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Progress WhatsUp Gold
CVE-2024-6670Progress WhatsUp Gold SQL Injection VulnerabilityProgress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Progress Telerik Report Server
CVE-2024-4358Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityProgress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Progress WS_FTP Server
CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data VulnerabilityProgress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Progress MOVEit Transfer
CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.CISA’s required actionApply updates per vendor instructions. - Progress Telerik UI for ASP.NET AJAX
CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data VulnerabilityProgress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.CISA’s required actionApply updates per vendor instructions. - Progress ASP.NET AJAX and Sitefinity
CVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness VulnerabilityProgress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Progress on CISA’s site.