Progress vulnerabilities in CISA KEV
Progress has 9 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 29th highest of any vendor. 1 was added in the last 12 months; 4 are linked to known ransomware use (44.4% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is WhatsUp Gold, with 2 entries. Other frequently affected products: ASP.NET AJAX and Sitefinity (1); Kemp LoadMaster (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor progress --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
9
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-08-07
most recent entry
┌─ last 12 months
1
entries added
┌─ ransomware use
4 of 9
44.4% linked to ransomware
┌─ distinct products
8
affected products
$ awk -F, {print $1} /var/log/kev/progress.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 2 | 1 |
| 2023 | 2 | 2 |
| 2024 | 3 | 1 |
| 2025 | 1 | 0 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/progress.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- WhatsUp Gold 2 entries
- ASP.NET AJAX and Sitefinity 1 entry
- Kemp LoadMaster 1 entry
- LoadMaster 1 entry
- MOVEit Transfer 1 entry
$ kev-due-dates --vendor progress
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Progress
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/progress.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (9 of 9 have at least one CWE).
$ grep -ril 'Progress' /var/log/news | head -5
Our reporting that names Progress or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./progress.kev · 9 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-8037
LoadMaster
Progress LoadMaster Command Injection Vulnerability
due 2026-08-10 · CWE-77
$ cat CVE-2026-8037.txt
Description. Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2024-4885
WhatsUp Gold
Progress WhatsUp Gold Path Traversal Vulnerability
due 2025-03-24 · CWE-22
$ cat CVE-2024-4885.txt
Description. Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-1212
Kemp LoadMaster
Progress Kemp LoadMaster OS Command Injection Vulnerability
due 2024-12-09 · CWE-78
$ cat CVE-2024-1212.txt
Description. Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-6670
WhatsUp Gold [RANSOMWARE]
Progress WhatsUp Gold SQL Injection Vulnerability
due 2024-10-07 · CWE-89
$ cat CVE-2024-6670.txt
Description. Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-4358
Telerik Report Server
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
due 2024-07-04 · CWE-290
$ cat CVE-2024-4358.txt
Description. Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-40044
WS_FTP Server [RANSOMWARE]
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
due 2023-10-26 · CWE-502
$ cat CVE-2023-40044.txt
Description. Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-34362
MOVEit Transfer [RANSOMWARE]
Progress MOVEit Transfer SQL Injection Vulnerability
due 2023-06-23 · CWE-89
$ cat CVE-2023-34362.txt
Description. Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
Required action. Apply updates per vendor instructions.
- CVE-2017-9248
ASP.NET AJAX and Sitefinity
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
due 2022-05-03 · CWE-522
$ cat CVE-2017-9248.txt
Description. Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
Required action. Apply updates per vendor instructions.
- CVE-2019-18935
Telerik UI for ASP.NET AJAX [RANSOMWARE]
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
due 2022-05-03 · CWE-502
$ cat CVE-2019-18935.txt
Description. Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.
Required action. Apply updates per vendor instructions.