Progress Software vulnerabilities
We track 269 vulnerabilities in Progress Software products across 60+ products. 269 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Progress Software vulnerabilities
- 7.8 High severity
Telerik UI for WinForms: Improper Neutralization of Special Elements used in a Command
In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.
- 9.8 Critical severity
Telerik UI for WPF: Deserialization of Untrusted Data
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
Telerik UI for WPF: Improper Neutralization of Special Elements used in a Command
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.
- 7.2 High severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above
- 9.6 Critical severity
OpenEdge: Improper Control of Generation of Code
Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platform
- 8.8 High severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.
- 9.8 Critical severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- 9.8 Critical severity
Progress WhatsUp Gold SQL Injection Exploited
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- 8.1 High severity
WS_FTP Server: Improper Authentication
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.
- 9.8 Critical severity
MOVEit Transfer: Improper Authentication
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.
- 9.8 Critical severity
Telerik Report Server: Deserialization of Untrusted Data
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 7.5 High severity
WhatsUp Gold: Improper Limitation of a Pathname to a Restricted Directory
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges.
- 7.5 High severity
WhatsUp Gold: Improper Limitation of a Pathname to a Restricted Directory
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory .
- 7.2 High severity
WhatsUp Gold: Deserialization of Untrusted Data
In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.D
- 8.8 High severity
WhatsUp Gold: Server-Side Request Forgery
In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to es
- 7.5 High severity
WhatsUp Gold: Uncontrolled Resource Consumption
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.
- 8.6 High severity
WhatsUp Gold: Improper Authentication
In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library.
- 7.5 High severity
WhatsUp Gold: Uncontrolled Resource Consumption
In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.
- 7.5 High severity
WhatsUp Gold: Exposure of Sensitive Information to an Unauthorized Actor
In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP request can lead to a disclosure of sensitive information.
- 8.4 High severity
WhatsUp Gold: Improper Privilege Management
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
- 8.8 High severity
WhatsUp Gold: Unrestricted Upload of File with Dangerous Type
In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController.
- 9.8 Critical severity
Progress WhatsUp Gold Path Traversal Exploited
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
- 9.8 Critical severity
WhatsUp Gold: Improper Neutralization of Special Elements used in a Command
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges.
- 9.8 Critical severity
WhatsUp Gold: Improper Neutralization of Special Elements used in a Command
In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.
- 9.8 Critical severity
MOVEit Transfer: Improper Authentication
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
- 9.1 Critical severity
MOVEit Gateway: Improper Authentication
Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0.
- 9.8 Critical severity
Progress Telerik Report Server Authentication Bypass by Spoofing Exploited
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- 8.6 High severity
Telerik Reporting: Improper Control of Generation of Code
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability.
- 7.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
- 7.5 High severity
LoadMaster: Use of Hard-coded Credentials
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communi
- 7.5 High severity
LoadMaster: Insufficiently Protected Credentials
Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.
- 9.8 Critical severity
Flowmon: Improper Neutralization of Special Elements used in an OS Command
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system
- 7.5 High severity
LoadMaster: Cross-Site Request Forgery
A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party sit
- 8.8 High severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.
- 8.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
- 7.8 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deserialization vulnerability.
- 8.8 High severity
Telerik Report Server: Deserialization of Untrusted Data
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
OpenEdge: Authentication Bypass by Primary Weakness
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a fail
- 9.8 Critical severity
Progress Kemp LoadMaster OS Command Injection Exploited
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.