Progress Software vulnerabilities
We track 269 vulnerabilities in Progress Software products across 60+ products. 269 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Progress Software vulnerabilities
- 9.8 Critical severity
MOVEit Transfer: Improper Authentication
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Deserialization of Untrusted Data
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Absolute Path Traversal
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Deserialization of Untrusted Data
In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Use of Hard-coded Cryptographic Key
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Observable Timing Discrepancy
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Generation of Error Message Containing Sensitive Information
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
- 8.7 High severity
In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an…
In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or dete
- 9.8 Critical severity
MOVEit Transfer: Path Equivalence: 'filename ' (Trailing Space)
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
- 8.8 High severity
MOVEit Transfer: Incorrect Authorization
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- 7.5 High severity
MOVEit Transfer: Authentication Bypass by Spoofing
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- 7.5 High severity
MOVEit Transfer: Relative Path Traversal
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- 9.8 Critical severity
MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- 7.5 High severity
MOVEit Transfer: Missing Release of Memory after Effective Lifetime
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- 7.2 High severity
MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- 8.1 High severity
Flowmon ADS: Improper Neutralization of Special Elements used in an SQL Command
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized a
- 7.3 High severity
Flowmon: Incorrect Authorization
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user,
- 9.8 Critical severity
Progress LoadMaster Command Injection Exploited
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
- 7.5 High severity
Sitefinity: Insufficiently Protected Credentials
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows
- 8.8 High severity
Sitefinity: Authorization Bypass Through User-Controlled Key
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, p
- 9.8 Critical severity
Sitefinity: Improper Access Control
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availabilit
- 8.1 High severity
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through…
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a re
- 7.5 High severity
MOVEit Automation: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- 7.5 High severity
MOVEit Automation: Incorrect Default Permissions
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- 7.5 High severity
MOVEit Automation: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- 7.5 High severity
MOVEit Automation: Memory Allocation with Excessive Size Value
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- 8.8 High severity
Improper input validation vulnerability in Progress Software MOVEit Automation allows…
Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 202
- 9.8 Critical severity
MOVEit Automation: Authentication Bypass by Primary Weakness
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
- 9.8 Critical severity
Telerik UI for ASP.NET AJAX: Deserialization of Untrusted Data
In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Uncontrolled Resource Consumption
In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly,
- 7.2 High severity
LoadMaster: Improper Neutralization of Special Elements used in a Command
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file
- 7.2 High severity
LoadMaster: Improper Neutralization of Special Elements used in a Command
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'acl
- 7.2 High severity
LoadMaster: Improper Neutralization of Special Elements used in a Command
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' comm
- 7.2 High severity
LoadMaster: Improper Neutralization of Special Elements used in a Command
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'ad
- 9.1 Critical severity
OpenEdge: Storing Passwords in a Recoverable Format
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immed
- 8.2 High severity
OpenEdge: Files or Directories Accessible to External Parties
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could a
- 8.8 High severity
Flowmon: Improper Neutralization of Special Elements used in an OS Command
In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.