Progress vulnerabilities

Published CVEs affecting Progress products: 106 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-9193 Critical · 9.9 CWE-269 Aug 5, 2026

Improper Privilege Management in Progress Marklogic Server

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

CVE-2026-9192 Critical · 9.8 CWE-287 Aug 5, 2026

Improper Authentication in Progress Marklogic Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

CVE-2026-9190 Critical · 9.1 CWE-444 Aug 5, 2026

HTTP Request Smuggling in Progress Marklogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

CVE-2026-8709 Critical · 9.9 CWE-269 Aug 5, 2026

Improper Privilege Management in Progress Marklogic Server

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.

CVE-2026-7557 Critical · 9.1 CWE-347 Aug 5, 2026

Improper Verification of Cryptographic Signature in Progress Marklogic Server

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.

CVE-2026-7329 Critical · 9.9 CWE-269 Aug 5, 2026

Improper Privilege Management in Progress Marklogic Server

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

CVE-2026-7327 High · 8.1 CWE-269 Aug 5, 2026

Improper Privilege Management in Progress Marklogic Server

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.

CVE-2026-7326 High · 8.8 CWE-352 Aug 5, 2026

Cross-Site Request Forgery (CSRF) in Progress Marklogic Server

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

CVE-2026-59690 High · 8.0 CWE-862 Jul 27, 2026

Missing Authorization in Progress Connection Manager For Objectscale

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

CVE-2026-59689 High · 8.0 CWE-863 Jul 27, 2026

Incorrect Authorization in Progress Connection Manager For Objectscale

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

CVE-2026-59688 High · 8.4 CWE-78 Jul 27, 2026

OS Command Injection in Progress Connection Manager For Objectscale

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

CVE-2026-59687 High · 8.4 CWE-78 Jul 27, 2026

OS Command Injection in Progress Connection Manager For Objectscale

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

CVE-2026-59686 High · 8.4 CWE-78 Jul 27, 2026

OS Command Injection in Progress Connection Manager For Objectscale

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

CVE-2026-15968 Medium · 5.4 CWE-79 Jul 23, 2026

Cross-site Scripting (XSS) in Progress Moveit Transfer

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVE-2026-15967 Critical · 9.8 CWE-613 Jul 23, 2026

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue…

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVE-2026-15966 Critical · 9.8 CWE-942 Jul 23, 2026

Permissive Cross-domain Policy in Progress Moveit Transfer

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVE-2026-10697 Critical · 9.8 CWE-287 Jul 23, 2026

Improper Authentication in Progress Moveit Transfer

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVE-2026-14932 Medium · 6.5 CWE-321 Jul 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

CVE-2026-14865 Medium · 5.3 CWE-776 Jul 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

CVE-2026-13192 Medium · 6.5 CWE-918 Jul 22, 2026

Server-Side Request Forgery (SSRF) in Progress Telerik Ui For Asp.net Ajax

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

CVE-2026-13190 High · 8.1 CWE-502 Jul 22, 2026

Deserialization of Untrusted Data in Progress Telerik Ui For Asp.net Ajax

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

CVE-2026-13189 High · 7.5 CWE-36 Jul 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.

CVE-2026-13188 Medium · 5.9 CWE-345 Jul 22, 2026

Insufficient Verification of Data Authenticity in Progress Telerik Ui For Asp.net Ajax

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.

CVE-2026-13187 High · 8.1 CWE-470 Jul 22, 2026

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

CVE-2026-13186 High · 8.1 CWE-22 Jul 22, 2026

Path Traversal in Progress Telerik Ui For Asp.net Ajax

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.