Progress — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Progress with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 9 Progress vulnerabilities confirmed as exploited in the wild across 8 products; 4 of them (44%) are flagged as used in known ransomware campaigns. WhatsUp Gold is the most-affected product, with 2 entries (22% of the total). CISA added 1 entry in 2026 so far, compared with 1 in 2025. Across the 9 entries with an NVD CVSS score (100% of the total), the average score is 9.8; 9 entries are rated critical by NVD. The most recent addition is CVE-2026-8037 (Progress LoadMaster Command Injection Vulnerability), added on 2026-08-07.
Affected products
| Product | Entries | Share |
|---|---|---|
| WhatsUp Gold | 2 | 22% |
| LoadMaster | 1 | 11% |
| Kemp LoadMaster | 1 | 11% |
| Telerik Report Server | 1 | 11% |
| WS_FTP Server | 1 | 11% |
| MOVEit Transfer | 1 | 11% |
| Telerik UI for ASP.NET AJAX | 1 | 11% |
| ASP.NET AJAX and Sitefinity | 1 | 11% |
Entries added per year
By date added to the KEV catalog
Exploited Progress vulnerabilities (9)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-8037 | LoadMaster | Progress LoadMaster Command Injection Vulnerability | 2026-08-07 | — | CRITICAL9.6 |
| CVE-2024-4885 | WhatsUp Gold | Progress WhatsUp Gold Path Traversal Vulnerability | 2025-03-03 | — | CRITICAL9.8 |
| CVE-2024-1212 | Kemp LoadMaster | Progress Kemp LoadMaster OS Command Injection Vulnerability | 2024-11-18 | — | CRITICAL10.0 |
| CVE-2024-6670 | WhatsUp Gold | Progress WhatsUp Gold SQL Injection Vulnerability | 2024-09-16 | Known | CRITICAL9.8 |
| CVE-2024-4358 | Telerik Report Server | Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | 2024-06-13 | — | CRITICAL9.8 |
| CVE-2023-40044 | WS_FTP Server | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | 2023-10-05 | Known | CRITICAL10.0 |
| CVE-2023-34362 | MOVEit Transfer | Progress MOVEit Transfer SQL Injection Vulnerability | 2023-06-02 | Known | CRITICAL9.8 |
| CVE-2019-18935 | Telerik UI for ASP.NET AJAX | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2017-9248 | ASP.NET AJAX and Sitefinity | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.