Progress Software vulnerabilities

CVEs per yearBy the year they were published

1. 202527
2. 202694
3. 202615

Known exploitedNewest addition to KEV first

• CVE-2026-8037

  OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

  Progress Software · LoadMaster

  ExploitedCritical9.6
• CVE-2024-1212

  LoadMaster Pre-Authenticated OS Command Injection

  Progress Software · LoadMaster

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-90872

  Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Medium6.6
• CVE-2026-90871

  Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Medium5.3
• CVE-2026-90870

  Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Medium5.3
• CVE-2026-90869

  Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  High7.5
• CVE-2026-90868

  OS Command Injection in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Critical9.9
• CVE-2026-90867

  Improper Access Control of Web Admin Console in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  High8.1
• CVE-2026-90866

  Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Critical9.1
• CVE-2026-90865

  Command Injection via FTP Notification Variables in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Critical9.0
• CVE-2026-90864

  Host Administrator Path Containment Bypass in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Critical9.1
• CVE-2026-90863

  Privilege Escalation via Missing Authorization in WS_FTP Manager

  Progress Software · WS_FTP Server

  Critical9.1