# cve.now: Progress

The newest entries naming Progress as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-89077](https://cve.now/CVE-2026-89077.md): MOVEit Transfer Identity validation flaw in SFTP authentication (CVSS 7.5)
- [CVE-2026-89076](https://cve.now/CVE-2026-89076.md): MOVEit Transfer SQL injection in custom reporting (CVSS 7.2)
- [CVE-2026-89075](https://cve.now/CVE-2026-89075.md): MOVEit Transfer Local Disclosure of Session Information Vulnerability (CVSS 7.3)
- [CVE-2026-89074](https://cve.now/CVE-2026-89074.md): MOVEit Transfer Email MFA Bypass (CVSS 7.5)
- [CVE-2026-89073](https://cve.now/CVE-2026-89073.md): MOVEit Transfer Access restriction bypass in OAuth authentication (CVSS 7.5)
- [CVE-2026-89072](https://cve.now/CVE-2026-89072.md): MOVEit Transfer Authorization Flaw in Certificate Management (CVSS 7.5)
- [CVE-2026-89071](https://cve.now/CVE-2026-89071.md): MOVEit Transfer LDAP injection in certificate-based authentication (CVSS 7.5)
- [CVE-2026-89070](https://cve.now/CVE-2026-89070.md): MOVEit Transfer OIDC Authentication Replay Vulnerability (CVSS 7.5)
- [CVE-2026-89069](https://cve.now/CVE-2026-89069.md): MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages (CVSS 8.0)
- [CVE-2026-89068](https://cve.now/CVE-2026-89068.md): MOVEit Transfer Authentication bypass in LDAP sign-on (CVSS 8.1)
- [CVE-2026-89067](https://cve.now/CVE-2026-89067.md): MOVEit Transfer Secure Messaging Authentication Bypass (CVSS 8.8)
- [CVE-2026-87093](https://cve.now/CVE-2026-87093.md): MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation (CVSS 8.8)
- [CVE-2026-93695](https://cve.now/CVE-2026-93695.md): Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService (CVSS 7.4)
- [CVE-2026-93694](https://cve.now/CVE-2026-93694.md): Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller (CVSS 4.0)
- [CVE-2026-93693](https://cve.now/CVE-2026-93693.md): Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller (CVSS 6.5)
- [CVE-2026-16137](https://cve.now/CVE-2026-16137.md): Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller (CVSS 7.2)
- [CVE-2026-16138](https://cve.now/CVE-2026-16138.md): Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service (CVSS 8.0)
- [CVE-2026-16139](https://cve.now/CVE-2026-16139.md): Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution (CVSS 7.2)
- [CVE-2026-15968](https://cve.now/CVE-2026-15968.md): Stored XSS vulnerability in MOVEit Transfer (CVSS 7.1)
- [CVE-2026-15967](https://cve.now/CVE-2026-15967.md): MOVEit Transfer refresh-token processing does not enforce updated account restrictions (CVSS 7.5)
- [CVE-2026-15966](https://cve.now/CVE-2026-15966.md): Improper CORS handling in MOVEit Transfer (CVSS 7.5)
- [CVE-2026-10697](https://cve.now/CVE-2026-10697.md): MFA Bypass in MOVEit Transfer (CVSS 7.5)
- [CVE-2026-15724](https://cve.now/CVE-2026-15724.md): Path traversal in Progress ShareFile Storage Zones Controller (SZC) (CVSS 8.7)
- [CVE-2026-8801](https://cve.now/CVE-2026-8801.md): File Extension Restriction Bypass in MOVEit Transfer (CVSS 3.5)
- [CVE-2026-8800](https://cve.now/CVE-2026-8800.md): Cross-Org External Token Metadata accessible to AuditUser role (CVSS 2.7)
- [CVE-2026-8651](https://cve.now/CVE-2026-8651.md): IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer (CVSS 3.7)
- [CVE-2026-8650](https://cve.now/CVE-2026-8650.md): Authenticated Path Traversal allows MOVEit admins to view arbitrary system files (CVSS 4.5)
- [CVE-2026-8649](https://cve.now/CVE-2026-8649.md): Institution scope bypass vulnerability in custom reports (CVSS 6.4)
- [CVE-2026-11903](https://cve.now/CVE-2026-11903.md): Stored XSS in MOVEit Transfer Ad Hoc module (CVSS 8.0)
- [CVE-2026-10699](https://cve.now/CVE-2026-10699.md): Memory leak in SFTP service can result in a denial of service in MOVEit Transfer (CVSS 7.5)
- [CVE-2026-10698](https://cve.now/CVE-2026-10698.md): Table scope bypass vulnerability in custom reports (CVSS 7.2)
- [CVE-2026-2701](https://cve.now/CVE-2026-2701.md): RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC) (CVSS 9.1)
- [CVE-2026-2699](https://cve.now/CVE-2026-2699.md): EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) (CVSS 9.8)
- [CVE-2025-11235](https://cve.now/CVE-2025-11235.md): MOVEit Transfer REST API does not require current password in order to initiate the password change process (CVSS 3.7)
- [CVE-2025-13147](https://cve.now/CVE-2025-13147.md): External Service Interaction (DNS) (CVSS 5.3)
- [CVE-2025-10703](https://cve.now/CVE-2025-10703.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress… (CVSS 8.6)
- [CVE-2025-10702](https://cve.now/CVE-2025-10702.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress… (CVSS 8.6)
- [CVE-2025-10932](https://cve.now/CVE-2025-10932.md): AS2 module allows uncontrolled file uploads (CVSS 8.2)
- [CVE-2025-1758](https://cve.now/CVE-2025-1758.md): Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: \* LoadMaster: 7.2.40.0 and above (CVSS 4.3)
- [CVE-2025-2324](https://cve.now/CVE-2025-2324.md): A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder (CVSS 5.9)
- [CVE-2024-56135](https://cve.now/CVE-2024-56135.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-56134](https://cve.now/CVE-2024-56134.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-56133](https://cve.now/CVE-2024-56133.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-56132](https://cve.now/CVE-2024-56132.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-56131](https://cve.now/CVE-2024-56131.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-11627](https://cve.now/CVE-2024-11627.md): : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thr (CVSS 6.8)
- [CVE-2024-8755](https://cve.now/CVE-2024-8755.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4)
- [CVE-2024-6658](https://cve.now/CVE-2024-6658.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection. (CVSS 8.4)
- [CVE-2024-7591](https://cve.now/CVE-2024-7591.md): Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection (CVSS 10.0)
- [CVE-2024-7346](https://cve.now/CVE-2024-7346.md): Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation (CVSS 7.2)
- [CVE-2024-7345](https://cve.now/CVE-2024-7345.md): Direct local client connections to MS Agents can bypass authentication (CVSS 8.3)
- [CVE-2024-7654](https://cve.now/CVE-2024-7654.md): Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service (CVSS 8.3)
- [CVE-2024-6576](https://cve.now/CVE-2024-6576.md): MOVEit Transfer Privilege Escalation Vulnerability (CVSS 7.3)
- [CVE-2024-5806](https://cve.now/CVE-2024-5806.md): MOVEit Transfer Authentication Bypass Vulnerability (CVSS 9.1)
- [CVE-2024-5805](https://cve.now/CVE-2024-5805.md): MOVEit Gateway Authentication Bypass Vulnerability (CVSS 9.1)
- [CVE-2024-1403](https://cve.now/CVE-2024-1403.md): Authentication Bypass in OpenEdge Authentication Gateway and AdminServer (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/progress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.