Progress vulnerabilities
56 CVEs and advisories name Progress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-89077MOVEit Transfer Identity validation flaw in SFTP authentication
- CVE-2026-89076MOVEit Transfer SQL injection in custom reporting
- CVE-2026-89075MOVEit Transfer Local Disclosure of Session Information Vulnerability
- CVE-2026-89074MOVEit Transfer Email MFA Bypass
- CVE-2026-89073MOVEit Transfer Access restriction bypass in OAuth authentication
- CVE-2026-89072MOVEit Transfer Authorization Flaw in Certificate Management
- CVE-2026-89071MOVEit Transfer LDAP injection in certificate-based authentication
- CVE-2026-89070MOVEit Transfer OIDC Authentication Replay Vulnerability
- CVE-2026-89069MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
- CVE-2026-89068MOVEit Transfer Authentication bypass in LDAP sign-on
- CVE-2026-89067MOVEit Transfer Secure Messaging Authentication Bypass
- CVE-2026-87093MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
- CVE-2026-93695Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
- CVE-2026-93694Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
- CVE-2026-93693Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
- CVE-2026-16137Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller
- CVE-2026-16138Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
- CVE-2026-16139Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution
- CVE-2026-15968Stored XSS vulnerability in MOVEit Transfer
- CVE-2026-15967MOVEit Transfer refresh-token processing does not enforce updated account restrictions
- CVE-2026-15966Improper CORS handling in MOVEit Transfer
- CVE-2026-10697MFA Bypass in MOVEit Transfer
- CVE-2026-15724Path traversal in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-8801File Extension Restriction Bypass in MOVEit Transfer
- CVE-2026-8800Cross-Org External Token Metadata accessible to AuditUser role
- CVE-2026-8651IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
- CVE-2026-8650Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
- CVE-2026-8649Institution scope bypass vulnerability in custom reports
- CVE-2026-11903Stored XSS in MOVEit Transfer Ad Hoc module
- CVE-2026-10699Memory leak in SFTP service can result in a denial of service in MOVEit Transfer