Cyberfeed6 › Vendors › Progress
CISA lists 9 Progress vulnerabilities as exploited in real attacks, and 4 of them are known to be used in ransomware campaigns. Most entries concern WhatsUp Gold, LoadMaster, Kemp LoadMaster, Telerik Report Server.
Showing the 9 most recently added of 9. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-8037Progress LoadMaster Command Injection Vulnerability | LoadMaster | 2026-08-07 | Critical (9.6) | No | Vendor notice |
| CVE-2024-4885Progress WhatsUp Gold Path Traversal Vulnerability | WhatsUp Gold | 2025-03-03 | Critical (9.8) | No | Vendor notice |
| CVE-2024-1212Progress Kemp LoadMaster OS Command Injection Vulnerability | Kemp LoadMaster | 2024-11-18 | Critical (10.0) | No | Vendor notice |
| CVE-2024-6670Progress WhatsUp Gold SQL Injection Vulnerability | WhatsUp Gold | 2024-09-16 | Critical (9.8) | Yes | Vendor notice |
| CVE-2024-4358Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | Telerik Report Server | 2024-06-13 | Critical (9.8) | No | Vendor notice |
| CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | WS_FTP Server | 2023-10-05 | Critical (10.0) | Yes | Vendor notice |
| CVE-2023-34362Progress MOVEit Transfer SQL Injection Vulnerability | MOVEit Transfer | 2023-06-02 | Critical (9.8) | Yes | Vendor notice |
| CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | Telerik UI for ASP.NET AJAX | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | ASP.NET AJAX and Sitefinity | 2021-11-03 | Critical (9.8) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.