Progress Software vulnerabilities
We track 269 vulnerabilities in Progress Software products across 60+ products. 269 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Progress Software vulnerabilities
- 8.6 High severity
MarkLogic Server: Improper Privilege Management
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the a
- 8.5 High severity
MarkLogic Server: Improper Limitation of a Pathname to a Restricted Directory
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized a
- 8.5 High severity
MarkLogic Server: Server-Side Request Forgery
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting i
- 8.5 High severity
MarkLogic Server: Server-Side Request Forgery
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthoriz
- 8.4 High severity
MarkLogic Server: Improper Privilege Management
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, pot
- 8.1 High severity
MarkLogic Server: Insertion of Sensitive Information into Log File
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain u
- 9.9 Critical severity
MarkLogic Server: Improper Privilege Management
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent
- 9.9 Critical severity
MarkLogic Server: Improper Privilege Management
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unau
- 7.4 High severity
ShareFile Storage Zones Controller: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to
- 8.9 High severity
Telerik Report Server: Improper Neutralization of Input During Web Page Generation
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text
- 7.1 High severity
Telerik Report Server: Incorrect Privilege Assignment
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted serv
- 7.3 High severity
Telerik Document Processing Libraries: Loop with Unreachable Exit Condition
In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsi
- 9.6 Critical severity
Autonomous REST Connector GenAI Agents: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execut
- 8.8 High severity
@progress/sitefinity-nextjs-sdk: Server-Side Request Forgery
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive inform
- 7.9 High severity
Progress® Telerik® Fiddler® Classic: Improper Verification of Cryptographic Signature
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the
- 7.7 High severity
Progress® Telerik® Fiddler® Everywhere: Missing Authentication for Critical Functionality
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost
- 10.0 Critical severity
Chef Automate: Missing Authentication for Critical Functionality
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Insufficient Verification of Data Authenticity
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders th
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the in
- 7.2 High severity
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an…
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparat
- 8.0 High severity
ShareFile Storage Zones Controller: Deserialization of Untrusted Data
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
- 7.2 High severity
ShareFile Storage Zones Controller: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the applicati
- 9.8 Critical severity
WhatsUp Gold: External Control of File Name or Path
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
- 8.5 High severity
MarkLogic Server: Server-Side Request Forgery
A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud cre
- 9.3 Critical severity
MarkLogic Server: Improper Limitation of a Pathname to a Restricted Directory
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser se
- 9.9 Critical severity
MarkLogic Server: Improper Privilege Management
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the S
- 9.8 Critical severity
MarkLogic Server: Improper Authentication
An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the
- 9.1 Critical severity
MarkLogic Server: Inconsistent Interpretation of HTTP Requests
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vul
- 9.9 Critical severity
MarkLogic Server: Improper Privilege Management
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations
- 9.1 Critical severity
MarkLogic Server: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including adm
- 9.9 Critical severity
MarkLogic Server: Improper Privilege Management
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This
- 8.1 High severity
MarkLogic Server: Improper Privilege Management
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthori
- 8.8 High severity
MarkLogic Server: Cross-Site Request Forgery
A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's
- 8.0 High severity
LoadMaster: Missing Authorization
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations vi
- 8.0 High severity
LoadMaster: Incorrect Authorization
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, pot
- 8.4 High severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected
- 8.4 High severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected
- 8.4 High severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected
- 9.8 Critical severity
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- 9.8 Critical severity
MOVEit Transfer: Permissive Cross-domain Security Policy with Untrusted Domains
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.