Skip to content
OpenAdvisories

Vendor

Progress

56 known vulnerabilities.

Progress at a glance

Last 12 months
37
Critical · all time
6
Exploited · all time
0
Public exploit · all time
4
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 2 vulnerabilities, 2 critical May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 13 vulnerabilities August 2026: 3 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 15 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 2026150
Sep 202600
Aug 202630
Jul 2026130
Jun 202600
May 202600
Apr 202622
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202530
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202520
Feb 202550
Jan 202510
Dec 202400

Products

MOVEit Transfer 30 ShareFile Storage Zones Controller 9 LoadMaster 9 OpenEdge 4 DataDirect Connect for JDBC for Amazon Redshift 2 DataDirect Connect for JDBC for Apache Cassandra 2 DataDirect Connect for JDBC for Hive 2 DataDirect Connect for JDBC for Apache Impala 2 DataDirect Connect for JDBC for Apache SparkSQL 2 DataDirect Connect for JDBC Autonomous REST Connector 2 DataDirect Connect for JDBC for DB2 2 DataDirect Connect for JDBC for Google Analytics 4 2 DataDirect Connect for JDBC for Google BigQuery 2 DataDirect Connect for JDBC for Greenplum 2 DataDirect Connect for JDBC for Informix 2 DataDirect Connect for JDBC for Microsoft Dynamics 365 2 DataDirect Connect for JDBC for Microsoft SQLServer 2 DataDirect Connect for JDBC for Microsoft Sharepoint 2 DataDirect Connect for JDBC for MongoDB 2 DataDirect Connect for JDBC for MySQL 2 DataDirect Connect for JDBC for Oracle Database 2 DataDirect Connect for JDBC for Oracle Eloqua 2 DataDirect Connect for JDBC for Oracle Sales Cloud 2 DataDirect Connect for JDBC for Oracle Service Cloud 2 DataDirect Connect for JDBC for PostgreSQL 2 DataDirect Connect for JDBC for Progress OpenEdge 2 DataDirect Connect for JDBC for Salesforce 2 DataDirect Connect for JDBC for SAP HANA 2 DataDirect Connect for JDBC for SAP S/4 HANA 2 DataDirect Connect for JDBC for Sybase ASE 2 DataDirect Connect for JDBC for Snowflake 2 DataDirect Hybrid Data Pipeline Server 2 DataDirect Hybrid Data Pipeline JDBC Driver 2 DataDirect Hybrid Data Pipeline On Premises Connector 2 DataDirect Hybrid Data Pipeline Docker 2 DataDirect OpenAccess JDBC Driver 2 MOVEit Gateway 1 Sitefinity 1 MOVEit Automation 0 MOVEit 0

Latest advisories

  • High max 8.0
    NCSC-2026-0226 3 CVEs

    Kwetsbaarheden verholpen in Progress MOVEit Transfer

    Progress heeft kwetsbaarheden verholpen in MOVEit Transfer, specifiek in de Custom Reports modules en de Ad Hoc module.

    Progress
  • High max 9.8
    NCSC-2026-0133 2 CVEs

    Kwetsbaarheden verholpen in Progress MOVEit Automation

    Progress heeft kwetsbaarheden verholpen in MOVEit Automation.

    Progress Software Progress
  • High max 5.3
    NCSC-2025-0375 1 CVE

    Kwetsbaarheid verholpen in Progress MOVEit Transfer

    Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies vóór 2024.1.8 en van 2025.0.0 tot vóór 2025.0.4).

    Progress
  • High max 8.2
    NCSC-2025-0346 1 CVE

    Kwetsbaarheid verholpen in Progress MOVEit Transfer

    Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies 2025.0.0 tot 2025.0.3, 2024.1.0 tot 2024.1.7, en 2023.1.0 tot 2023.1.16).

    Progress
  • High max 10.0
    NCSC-2024-0360 1 CVE

    Kwetsbaarheid verholpen in Kemp LoadMaster

    Kemp Technologies heeft een kwetsbaarheid verholpen in Kemp LoadMaster en Progress LoadMaster.

    Progress Kemp
All Critical High Medium Low Exploited only Public exploit

56 results · Feed

  • High 7.5
    CVE-2026-89077

    MOVEit Transfer Identity validation flaw in SFTP authentication

    Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.2
    CVE-2026-89076

    MOVEit Transfer SQL injection in custom reporting

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.3
    CVE-2026-89075

    MOVEit Transfer Local Disclosure of Session Information Vulnerability

    Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89074

    MOVEit Transfer Email MFA Bypass

    Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89073

    MOVEit Transfer Access restriction bypass in OAuth authentication

    Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89072

    MOVEit Transfer Authorization Flaw in Certificate Management

    Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89071

    MOVEit Transfer LDAP injection in certificate-based authentication

    Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89070

    MOVEit Transfer OIDC Authentication Replay Vulnerability

    Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.0
    CVE-2026-89069

    MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.1
    CVE-2026-89068

    MOVEit Transfer Authentication bypass in LDAP sign-on

    Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.8
    CVE-2026-89067

    MOVEit Transfer Secure Messaging Authentication Bypass

    Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.8
    CVE-2026-87093

    MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

    Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.4
    CVE-2026-93695

    Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService

    In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to…

    Progress ShareFile Storage Zones Controller
  • Medium 4.0
    CVE-2026-93694

    Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

    In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker…

    Progress ShareFile Storage Zones Controller
  • Medium 6.5
    CVE-2026-93693

    Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

    In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated at…

    Progress ShareFile Storage Zones Controller
  • High 7.2
    CVE-2026-16137

    Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

    In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the applicat…

    Progress ShareFile Storage Zones Controller
  • High 8.0
    CVE-2026-16138

    Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

    In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

    Progress ShareFile Storage Zones Controller
  • High 7.2
    CVE-2026-16139

    Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

    In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended prepara…

    Progress ShareFile Storage Zones Controller
  • High 7.1
    CVE-2026-15968

    Stored XSS vulnerability in MOVEit Transfer

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-15967

    MOVEit Transfer refresh-token processing does not enforce updated account restrictions

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-15966

    Improper CORS handling in MOVEit Transfer

    Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-10697

    MFA Bypass in MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 8.7
    CVE-2026-15724

    Path traversal in Progress ShareFile Storage Zones Controller (SZC)

    In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or det…

    Progress ShareFile Storage Zones Controller
  • Low 3.5
    CVE-2026-8801

    File Extension Restriction Bypass in MOVEit Transfer

    Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

    Progress MOVEit Transfer
  • Low 2.7
    CVE-2026-8800

    Cross-Org External Token Metadata accessible to AuditUser role

    Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Low 3.7
    CVE-2026-8651

    IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

    Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Medium 4.5
    CVE-2026-8650

    Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

    Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Medium 6.4
    CVE-2026-8649

    Institution scope bypass vulnerability in custom reports

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • High 8.0
    CVE-2026-11903

    Stored XSS in MOVEit Transfer Ad Hoc module

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 bef…

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-10699

    Memory leak in SFTP service can result in a denial of service in MOVEit Transfer

    Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

    Progress MOVEit Transfer
  • High 7.2
    CVE-2026-10698

    Table scope bypass vulnerability in custom reports

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

    Progress MOVEit Transfer
  • Critical 9.1
    CVE-2026-2701 EPSS 55%

    RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

    Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

    Progress ShareFile Storage Zones Controller
  • Critical 9.8
    CVE-2026-2699 Public exploit EPSS 58%

    EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

    Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

    Progress ShareFile Storage Zones Controller
  • Low 3.7
    CVE-2025-11235

    MOVEit Transfer REST API does not require current password in order to initiate the password change process

    Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

    Progress MOVEit Transfer
  • Medium 5.3
    CVE-2025-13147

    External Service Interaction (DNS)

    Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

    Progress MOVEit Transfer
  • High 8.6
    CVE-2025-10703

    Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers…

    Progress DataDirect Connect for JDBC for Informix DataDirect Connect for JDBC for Snowflake DataDirect Connect for JDBC for Apache Impala
  • High 8.6
    CVE-2025-10702

    Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers…

    Progress DataDirect Connect for JDBC for Microsoft Dynamics 365 DataDirect Hybrid Data Pipeline Server DataDirect Connect for JDBC for Apache SparkSQL
  • High 8.2
    CVE-2025-10932

    AS2 module allows uncontrolled file uploads

    Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

    Progress MOVEit Transfer
  • Medium 4.3
    CVE-2025-1758

    Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster…

    Progress LoadMaster
  • Medium 5.9
    CVE-2025-2324

    A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder

    Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2…

    Progress MOVEit Transfer