Progress

CVEs currently on EVULNABLE's Priority Feed for Progress, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 1 added.

May

Jun

Jul

Aug

Sep

Oct

Not ransomware-linked
Ransomware-linked
This week (so far)

CISA KEV additions per week, last 26 weeks
Week of	Added to KEV	Ransomware-linked
2026-04-20	0	0
2026-04-27	0	0
2026-05-04	0	0
2026-05-11	0	0
2026-05-18	0	0
2026-05-25	0	0
2026-06-01	0	0
2026-06-08	0	0
2026-06-15	0	0
2026-06-22	0	0
2026-06-29	0	0
2026-07-06	0	0
2026-07-13	0	0
2026-07-20	0	0
2026-07-27	0	0
2026-08-03	1	0
2026-08-10	0	0
2026-08-17	0	0
2026-08-24	0	0
2026-08-31	0	0
2026-09-07	0	0
2026-09-14	0	0
2026-09-21	0	0
2026-09-28	0	0
2026-10-05	0	0
2026-10-12 (so far)	0	0

In EVULNABLE's ranked feed

Showing all 9 Progress CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2023-34362 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Progress — Progress MOVEit Transfer SQL Injection Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.97th pctlKEV since2023-06-02

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#2 94 Immediate CVE-2019-18935 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Progress — Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.7% · 99.95th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#3 92 Immediate CVE-2024-6670 ExigentKEV since 2024 · listed over a yearRansomwareCISA KEV Progress — Progress WhatsUp Gold SQL Injection Vulnerability

EVRS 92/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS93.0% · 99.83rd pctlKEV since2024-09-16

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#4 90 Immediate CVE-2023-40044 KEV since 2023 · listed over a yearRansomwareCISA KEV Progress — Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

EVRS 90/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS90.4% · 99.8th pctlKEV since2023-10-05

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#5 88 Immediate CVE-2024-4885 ExigentKEV since 2025 · listed over a yearCISA KEV Progress — Progress WhatsUp Gold Path Traversal Vulnerability

EVRS 88/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.3% · 99.94th pctlKEV since2025-03-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.993.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#6 87 Immediate CVE-2024-1212 ExigentKEV since 2024 · listed over a yearCISA KEV Progress — Progress Kemp LoadMaster OS Command Injection Vulnerability

EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS95.4% · 99.87th pctlKEV since2024-11-18

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.954.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#7 86 Immediate CVE-2024-4358 ExigentKEV since 2024 · listed over a yearCISA KEV Progress — Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS97.5% · 99.9th pctlKEV since2024-06-13

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.975.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#8 85 Immediate CVE-2026-8037 CISA federal deadline · Overdue by 2 monthsCISA KEV Progress — Progress LoadMaster Command Injection Vulnerability

EVRS 85/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS77.4% · 99.56th pctlKEV since2026-08-07

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.774.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#9 80 Urgent CVE-2017-9248 KEV since 2021 · listed over a yearCISA KEV Progress — Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

EVRS 80/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS75.1% · 99.51st pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.751.

Full CVE page NVD ↗CISA KEV ↗