Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

Progress: actively exploited vulnerabilities

9 vulnerabilities in Progress products are listed in CISA’s catalog of actively exploited vulnerabilities, 4 of them used by ransomware. Latest addition on August 7, 2026: CVE-2026-8037 (LoadMaster).

Affected products

  • WhatsUp Gold2
  • ASP.NET AJAX and Sitefinity1
  • Kemp LoadMaster1
  • LoadMaster1
  • MOVEit Transfer1
  • Telerik Report Server1
  • Telerik UI for ASP.NET AJAX1
  • WS_FTP Server1

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 1 vulnerability

  1. CVE-2026-8037

    Progress LoadMaster Command Injection Vulnerability

    NVD entryCISA catalog

2025 1 vulnerability

  1. CVE-2024-4885

    Progress WhatsUp Gold Path Traversal Vulnerability

    NVD entryCISA catalog

2024 3 vulnerabilities

  1. CVE-2024-1212

    Progress Kemp LoadMaster OS Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2024-6670Used by ransomware

    Progress WhatsUp Gold SQL Injection Vulnerability

    NVD entryCISA catalog

  3. CVE-2024-4358

    Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

    NVD entryCISA catalog

2023 2 vulnerabilities

  1. CVE-2023-40044Used by ransomware

    Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-34362Used by ransomware

    Progress MOVEit Transfer SQL Injection Vulnerability

    NVD entryCISA catalog

2021 2 vulnerabilities

  1. CVE-2019-18935Used by ransomware

    Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

    NVD entryCISA catalog

  2. CVE-2017-9248

    Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.