CVE Intelligence

Progress vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Progress products: 65 record(s), with severity, exploitation and fixes.

Moveit Transfer 24Loadmaster 8Connection Manager For Objectscale 7Ecs Connection Manager 7Sitefinity 6Moveit Automation 6Sharefile Storage Zones Controller 5Flowmon Anomaly Detection System 4Telerik Ui For Asp.net Ajax 4Flowmon 3DataDirect Connect for JDBC for MySQL 2DataDirect Connect for JDBC for Microsoft Sharepoint 2DataDirect Connect for JDBC for MongoDB 2DataDirect OpenAccess JDBC Driver 2DataDirect Connect for JDBC for Oracle Database 2DataDirect Connect for JDBC for Oracle Eloqua 2DataDirect Connect for JDBC for Oracle Sales Cloud 2DataDirect Connect for JDBC for Oracle Service Cloud 2DataDirect Connect for JDBC for PostgreSQL 2DataDirect Connect for JDBC for Progress OpenEdge 2DataDirect Connect for JDBC for Salesforce 2DataDirect Connect for JDBC for SAP HANA 2DataDirect Connect for JDBC for SAP S/4 HANA 2DataDirect Connect for JDBC for Sybase ASE 2DataDirect Connect for JDBC for Snowflake 2DataDirect Hybrid Data Pipeline Server 2DataDirect Hybrid Data Pipeline JDBC Driver 2DataDirect Hybrid Data Pipeline On Premises Connector 2DataDirect Hybrid Data Pipeline Docker 2DataDirect Connect for JDBC for Apache Impala 2Moveit Web Application Firewall 2Whatsup Gold 2Multi-tenant Hypervisor 2DataDirect Connect for JDBC for Amazon Redshift 2DataDirect Connect for JDBC for Apache Cassandra 2DataDirect Connect for JDBC for Hive 2DataDirect Connect for JDBC for Microsoft SQLServer 2DataDirect Connect for JDBC for Apache SparkSQL 2DataDirect Connect for JDBC Autonomous REST Connector 2DataDirect Connect for JDBC for DB2 2

Exploited only (KEV) →

CVE-2026-89077 High · 7.5 CWE-303 Oct 14, 2026
MOVEit Transfer Identity validation flaw in SFTP authentication
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89076 High · 7.2 CWE-89 Oct 14, 2026
MOVEit Transfer SQL injection in custom reporting
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89075 High · 7.3 CWE-922 Oct 14, 2026
MOVEit Transfer Local Disclosure of Session Information Vulnerability
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89074 High · 7.5 CWE-176 Oct 14, 2026
MOVEit Transfer Email MFA Bypass
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89073 High · 7.5 CWE-613 Oct 14, 2026
MOVEit Transfer Access restriction bypass in OAuth authentication
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89072 High · 7.5 CWE-863 Oct 14, 2026
MOVEit Transfer Authorization Flaw in Certificate Management
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89071 High · 7.5 CWE-90 Oct 14, 2026
MOVEit Transfer LDAP injection in certificate-based authentication
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89070 High · 7.5 CWE-294 Oct 14, 2026
MOVEit Transfer OIDC Authentication Replay Vulnerability
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89069 High · 8.0 CWE-79 Oct 14, 2026
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89068 High · 8.1 CWE-304 Oct 14, 2026
MOVEit Transfer Authentication bypass in LDAP sign-on
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-87093 High · 8.8 CWE-732 Oct 14, 2026
MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-89067 High · 8.8 CWE-288 Oct 14, 2026
MOVEit Transfer Secure Messaging Authentication Bypass
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-93695 High · 7.4 CWE-22 Oct 12, 2026
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
CVE-2026-93694 Medium · 4.0 CWE-321 Oct 12, 2026
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
CVE-2026-93693 Medium · 6.5 CWE-20 Oct 12, 2026
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
CVE-2026-8801 Critical · 9.8 CWE-46 Jul 8, 2026
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This…
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
CVE-2026-8800 High · 8.8 CWE-863 Jul 8, 2026
Incorrect Authorization in Progress Moveit Transfer
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
CVE-2026-8651 High · 7.5 CWE-290 Jul 8, 2026
Authentication Bypass by Spoofing in Progress Moveit Transfer
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
CVE-2026-8650 High · 7.5 CWE-23 Jul 8, 2026
Relative Path Traversal in Progress Moveit Transfer
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
CVE-2026-8649 Critical · 9.8 CWE-943 Jul 8, 2026
Improper Neutralization of Special Elements in Data Query Logic vulnerability in…
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
CVE-2026-11903 Medium · 5.4 CWE-79 Jul 8, 2026
Cross-site Scripting (XSS) in Progress Moveit Transfer
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.
CVE-2026-10699 High · 7.5 CWE-401 Jul 8, 2026
Missing Release of Memory after Effective Lifetime in Progress Moveit Transfer
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
CVE-2026-10698 High · 7.2 CWE-943 Jul 8, 2026
Improper Neutralization of Special Elements in Data Query Logic vulnerability in…
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
CVE-2026-9272 High · 8.1 CWE-89 Jul 2, 2026
Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.
CVE-2026-8079 High · 7.3 CWE-863 Jul 2, 2026
Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration.