Progress Software
Monthly
A crafted XLSX or XLS workbook, or a crafted formula inside one, can terminate or hang the host process that parses it with RadSpreadProcessing or RadSpreadStreamProcessing in Progress Telerik Document Processing Libraries before 2026.3.1027. The root cause is a cluster of resource-consumption defects (CWE-674 uncontrolled recursion, infinite loop, unchecked loop condition, inefficient regular expression) reachable without authentication or user interaction at the library level, giving a high availability-only impact (CVSS 7.5, A:H, no confidentiality or integrity effect). The practical exposure depends on deployment: any application feature that accepts and processes untrusted spreadsheets is exposed, while installations that only process trusted internal documents effectively avoid the remote path; no public exploit code is identified in the available data and the vendor's stated complete fix is upgrading to 2026.3.1027 or later.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows unauthenticated remote attackers to hang or terminate the host process by submitting a crafted PDF to RadPdfProcessing or crafted document text to the AI document summarization and question-answering features (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The flaw is reachable only where an application built on the libraries exposes PDF upload or AI summarization intake to untrusted users; installations that process only trusted internal documents are not realistically exposed, and there is no data disclosure or code execution. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the vendor states that upgrading to version 2026.3.1027 is the only complete fix. This is a genuine but moderate-priority availability issue rather than a high-severity emergency.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an unauthenticated remote attacker to terminate or hang the host process by supplying a crafted DOCX, DOC, RTF, or HTML document to RadWordsProcessing. The flaw involves uncontrolled recursion, inefficient algorithmic complexity, and infinite-loop conditions during parsing, with impact limited to availability. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
RadPdfProcessing, the PDF component of Progress Telerik Document Processing Libraries before version 2026.3.1027, performs improper verification of cryptographic signatures and improper certificate validation when validating signed PDFs. Per the vendor CVSS vector the flaw is remotely reachable without authentication or user interaction and yields an integrity-only impact (C:N/I:H/A:N, score 7.5), because a crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid. Exposure is limited to applications that actually call this library to verify PDF signatures and then act on the verification result as a trust decision; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor-published advisory places it on a this-week remediation cadence.
XML external entity injection in Progress Telerik Document Processing Libraries before 2026.3.1027 allows remote unauthenticated attackers to read local files on the server when an application processes or exports a crafted SVG image to PDF. The malicious input uses a nested embedded SVG carrying an external entity reference, and the CVSS 3.1 vector rates confidentiality impact High with no integrity or availability impact. No public exploit was identified at time of analysis, and practical exposure depends on whether the host application renders or PDF-exports untrusted SVG content.
Path traversal in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an authenticated, low-privilege user who can supply arguments to the Convert and Merge AI agent tools to read files outside the configured output directory and to overwrite any of those files that the process account can write. Supplied relative paths resolve against the process's current working directory instead of being confined to the output directory, yielding high confidentiality and limited integrity impact (CVSS 7.1, PR:L). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's complete fix is an update to 2026.3.1027 or later, which puts this in the 'this week' remediation queue rather than an emergency.
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Insufficient access controls in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) allow a remote, authenticated attacker holding only limited management privileges to read security-sensitive information, which can then be used to reach protected resources outside that account's intended scope. The CVE carries a 7.7 score with a scope-changing vector (S:C) because the confidentiality impact crosses a privilege boundary, but exploitation is gated on the attacker already possessing a valid low-privilege management account (PR:L), and no user interaction is required. No public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exposure concentrates in multi-tenant or role-segmented installations, or as a lateral-movement step after an initial account compromise.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Stored cross-site scripting in Progress Telerik Report Server versions prior to 12.2.26.1007 allows an authenticated report author to execute arbitrary script in another user's session by embedding javascript: or vbscript: URLs in report navigation actions or HTML text-box links. When a higher-privilege user, such as an administrator, views the malicious report and triggers the embedded navigation, the script runs in the web report viewer's origin, enabling privilege escalation in multi-user deployments. The vulnerability has a CVSS score of 8.9, requires authentication and user interaction, and no public exploit has been identified at time of analysis.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
Denial of service in Progress Telerik Document Processing's SpreadProcessing library (all versions prior to 2026.3.1006) allows unauthenticated remote attackers to hang an application CPU thread indefinitely by supplying a specifically corrupted XLS spreadsheet for import. The crafted file drives the XLS import routine into an infinite loop that ignores the library's configured import timeout, so the built-in timeout safeguard offers no protection and the affected worker thread becomes permanently unresponsive. Practical exposure depends on whether the host application actually accepts XLS uploads or imports from untrusted sources; no public exploit code or confirmed active exploitation has been identified at time of analysis, and impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the vendor publishing a base score of 7.3.
OS command injection in Progress Software's Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 allows attacker-controlled shell metacharacters embedded in a Swagger/OpenAPI schema name to run as arbitrary OS commands on a developer's workstation, because the derived {fileName} value is interpolated unquoted into the agent's shell-based temporary-file cleanup commands (rm -f / del /Q / rmdir). Exploitation is unauthenticated from a network perspective (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: a developer must load the attacker-supplied API specification into the generator, which is reflected in the UI:R metric and the 9.6 score with Scope:Changed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but a vendor patch (upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 plus the Progress DataDirect Critical Security Alert Bulletin, September 2026) is available.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Privilege escalation in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a local low-privileged attacker replace one of the application's external helper executables with a different, validly signed binary that passes the product's weak publisher-name allow-list check, causing Fiddler to launch attacker-chosen code - including elevated (Administrator) execution for the helper tools that request elevation. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9), requires write access to the installed helper binaries, and is gated on a user launching the affected tool and approving the elevation prompt without noticing the executable name changed; it is not remotely or unauthenticated exploitable, and there is no public exploit identified at time of analysis. The authoritative assessment rates this a moderate, locally-exploitable privilege-escalation flaw rather than a drop-everything priority, with the UI:R requirement and the need for a pre-existing local foothold being the main limits on real-world abuse.
Progress Software Fiddler Everywhere 8.0.2 ships a local .NET backend (Fiddler.WebUi) that exposes an HTTP and SignalR RPC endpoint on the loopback interface without any authentication, allowing any local user or process on the same machine to call privileged methods, mint OAuth tokens, and export the application's machine-in-the-middle root certificate. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7) and only exploitable while Fiddler Everywhere is installed and running, but it requires no credentials or user interaction once those conditions hold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the practical risk is credential and trust-anchor theft on shared workstations or hosts where untrusted local software can execute.
Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
Path traversal in the RadImageEditor component of Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.3.812) allows unauthenticated remote attackers to read arbitrary files from the server by supplying crafted state values that manipulate the control's image cache lookup. The vulnerability stems from insufficient server-side validation of client-controlled input that determines which file the cache mechanism retrieves, enabling directory traversal beyond the intended image directories. No public exploit has been identified at time of analysis, but the low-complexity unauthenticated attack vector makes this a practical risk for any internet-exposed ASP.NET application using RadImageEditor.
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis.
OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.
Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs.
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
SQL injection in Progress Flowmon ADS (Anomaly Detection System) before versions 12.5.6 and 13.0.5 allows a low-privileged authenticated user to read and modify application data by sending specially crafted requests. The CVSS 4.0 base score of 8.7 (High) reflects high confidentiality and integrity impact plus availability impact over the network with only low privileges required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated OS command injection in the API of Progress ADC products - LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF - allows remote attackers to execute arbitrary commands on the appliance by supplying unsanitized input to multiple command endpoints. The flaw carries a CVSS of 9.8 (pre-auth, network-reachable) and publicly available exploit code exists (a GitHub PoC and watchTowr Labs write-up), though EPSS remains low at 0.30% and CISA SSVC currently rates exploitation status as 'none'. Fixed builds (7.2.63.2 and 7.2.54.18) are available from Progress.
Uncontrolled resource allocation in Progress Software MOVEit Automation lets remote unauthenticated attackers exhaust system resources and force a denial-of-service condition against affected instances (all releases before 2025.0.11 and the 2025.1.x line before 2025.1.7). The flaw carries no confidentiality or integrity impact - availability only - and there is no public exploit identified at time of analysis, with EPSS placing exploitation probability at just 0.04% (12th percentile) and CISA SSVC recording no observed exploitation.
Sensitive-data exposure in Progress MOVEit Automation allows remote attackers to retrieve embedded secrets because the product ships with incorrect default permissions (CWE-276), affecting all versions before 2025.0.11 and the 2025.1.x line before 2025.1.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.02%, 7th percentile), and CISA SSVC rates exploitation as none and non-automatable, so despite the high CVSS this is not currently a widespread exploitation risk.
Denial of service in Progress MOVEit Automation before 2025.0.11 and 2025.1.x before 2025.1.7 lets remote unauthenticated attackers exhaust availability by flooding the service with requests that allocate resources without limits or throttling. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%), but the CVSS 7.5 rating reflects a clean network, no-authentication path to disrupting the file-transfer automation engine. Impact is limited to availability - no data confidentiality or integrity loss occurs.
Improper input validation in Progress MOVEit Automation enables authenticated low-privilege attackers to escalate privileges and cause high-impact denial of service across container boundaries. Affecting all versions prior to 2025.1.5, 2025.0.9, and 2024.1.8, this network-accessible vulnerability with low attack complexity allows attackers to disrupt availability system-wide. Progress issued a Critical Security Alert Bulletin addressing this issue alongside CVE-2026-4670 in their April 2026 advisory. No public exploit identified at time of analysis, but the straightforward attack path (AV:N/AC:L/PR:L) and Changed scope indicate significant real-world risk for organizations running unpatched instances.
Authentication bypass in Progress MOVEit Automation allows remote unauthenticated attackers to completely circumvent authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. Affects all versions before 2025.0.9, all 2024.x versions before 2024.1.8, and all versions prior to 2024.0.0. Progress Software has released patches for all supported versions. CVSS 9.8 critical severity with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit or active exploitation confirmed at time of analysis, though the authentication bypass nature and MOVEit's history as a high-value target make this a priority remediation candidate.
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allows unauthenticated remote attackers to execute arbitrary code on the server by tampering with exposed client-side filter state. Affected versions span 2024.4.1114 through 2026.1.421. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis. The CVSS 8.1 (High) reflects network accessibility but 'High' attack complexity (AC:H), indicating successful exploitation requires specific conditions beyond simple network access.
Uncontrolled resource consumption in Progress Telerik UI for AJAX RadAsyncUpload component allows remote unauthenticated attackers to exhaust disk space by uploading files exceeding configured size limits through chunked upload bypass. The vulnerability arises from missing cumulative size validation during chunk reassembly, enabling attackers to circumvent intended upload restrictions. No authentication required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making this exploitable against any internet-facing application using affected versions. Patch available in version 2026.1.421. No CISA KEV listing or public exploit code identified at time of analysis, but low attack complexity and no authentication barrier indicate straightforward exploitation potential.
OS command injection in Progress LoadMaster and related ADC products allows authenticated administrators with 'All' permissions to execute arbitrary commands via malicious WAF rule file uploads. The attacker exploits unsanitized input during the file upload process in the web UI. With CVSS 8.4 and scope change to 'Changed', successful exploitation enables complete system compromise beyond the vulnerable component. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. EPSS data not available for risk assessment.
Command injection in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF allows authenticated administrators with 'VS Administration' privileges to execute arbitrary operating system commands on the appliance via unsanitized input to the 'aclcontrol' API command. CVSS 8.4 reflects high-privilege requirement but scope change indicates container escape or cross-boundary impact. EPSS data not provided. No public exploit identified at time of analysis. Vendor-released patch: version 7.2.63.0 for all affected products per Progress advisory.
OS command injection in Progress LoadMaster, MOVEit WAF, ECS Connections Manager, and Object Scale Connection Manager API allows authenticated attackers with 'All' permissions to execute arbitrary commands on appliances via unsanitized input in the 'killsession' API endpoint. CVSS 8.4 (High) reflects adjacent network access vector and high privileges requirement, limiting exploitation to administrators or compromised admin accounts. CISA SSVC assessment indicates no active exploitation, non-automatable attack, but total technical impact. EPSS data not provided, but privilege requirements significantly reduce real-world attack surface compared to unauthenticated RCE vulnerabilities.
Command injection in Progress LoadMaster and related ADC products allows authenticated attackers with Geo Administration permissions to execute arbitrary OS commands on appliances via the unsanitized 'addcountry' API parameter. Affects LoadMaster, ECS Connections Manager, MOVEit WAF, and Object Scale Connection Manager versions prior to 7.2.63.0. EPSS data unavailable; not listed in CISA KEV. CVSS 8.4 reflects high impact (complete system compromise) but requires adjacent network access and high-privilege authentication, significantly constraining real-world exploitation scenarios. Vendor has released patches addressing all affected products.
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to execute malicious JavaScript in administrator sessions via crafted links. Affected versions: Flowmon 12.x prior to 12.5.8 and 13.x prior to 13.0.6. CVSS 8.5 (High) reflects network-based delivery with low complexity requiring privileged access and user interaction. EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV); SSVC designates exploitation status as 'none' with non-automatable attack requiring user interaction for total technical impact. Vendor Progress Software released patches addressing the XSS flaw.
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (versions 2022.3.1109 up to but not including 2026.3.1015) allows an attacker who can influence the URL of a ToolBar ButtonGroup button to inject extra HTML attributes - including an event handler - and execute JavaScript in a victim's browser when that button is interacted with. The flaw is unauthenticated from the network perspective (CVSS:3.1/AV:N/PR:N) but requires user interaction (UI:R) and is rated high complexity (AC:H) because the payload must break out of an unquoted attribute; impact is scoped to the application's browser context with low confidentiality and integrity effects (C:L/I:L/A:N, base score 4.7). This is a genuine but comparatively low-urgency issue: no public exploit code exists and there is no confirmation of active exploitation (not listed in CISA KEV), and the vendor has released a fix in version 2026.3.1015.
Stored/DOM cross-site scripting in Progress Kendo UI for jQuery (Scheduler widget, versions 2026.3.811 and earlier) allows an attacker who can control a scheduler resource's color value to inject extra HTML attributes - including event handlers - into the quoted event wrapper attributes rendered by the Day, Timeline, Month, and Agenda views, so JavaScript executes in a victim's browser when the affected event is interacted with. Successful exploitation compromises the confidentiality and integrity of data accessible to the host application, though severity is limited by high attack complexity (AC:H), mandatory victim interaction (UI:R), and the practical need for write access to resource data (assessed PR:L; the vendor published PR:N). No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; the vendor-released fix is version 2026.3.1015.
Cross-site scripting (XSS) in the PanelBar component of Progress Kendo UI for jQuery (versions 2019.2.514 through before 2026.3.1015) allows unauthenticated remote attackers who can influence PanelBar item URL values to inject additional HTML attributes, including event handlers, into a single-quoted href attribute, resulting in JavaScript execution in a victim's browser upon interaction with the crafted item. Exploitation requires that the target application binds the PanelBar to a data source with attacker-controllable URLs and that a victim interacts with the item, making it a moderate-severity issue (CVSS 4.7) with high attack complexity. No public exploit code has been identified at time of analysis, and the vulnerability is fully remediated by upgrading to version 2026.3.1015.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Cross-site scripting in the Kendo UI for jQuery FileBrowser and ImageBrowser components (v2023.1.117 through pre-v2026.3.1015) lets a file or directory name containing script-related HTML execute JavaScript in the browser of any user who opens the affected browse dialog, compromising the confidentiality and integrity of data reachable in that application origin. Exploitation is conditional: an attacker must be able to influence the name of a file or directory that the component enumerates (typically via an upload or a shared storage path), and the payload only fires when a victim actually views the FileBrowser or ImageBrowser view - the independent assessment therefore scores this AV:N/AC:L/PR:L/UI:R (6.5) rather than the vendor's PR:N/UI:N vector. Impact is confined to the victim's browser context with no server-side code execution; no public exploit code was identified at time of analysis and there is no CISA KEV listing, but a fixed release (v2026.3.1015) is available.
Moderate-severity cross-site scripting (XSS) in Progress Kendo UI for Vue's chart component (@progress/kendo-vue-charts) versions 2.5.0 through 16.1.x allows an authenticated attacker with low privileges to inject malicious HTML into chart tooltip values, which executes JavaScript when a victim hovers over a data point. The default chart tooltip renders formatted point values as raw HTML without encoding, leading to potential compromise of data confidentiality and integrity. No public exploit identified at time of analysis. Exploitation requires the attacker to influence a string value bound to the chart and the victim to interact with the tooltip (UI:R).
Progress KendoReact's default chart tooltip fails to HTML-encode formatted point values, enabling a low-privileged attacker who can influence chart-bound string data to inject JavaScript that executes when a victim hovers over the affected data point. This stored/influenced XSS affects @progress/kendo-react-charts versions 1.1.0 through 16.1.x and requires user interaction, with a moderate CVSS score of 5.4. No public exploit code or active exploitation is known at this time, and upgrading to 16.2.0 or later eliminates the flaw.
Local privilege abuse in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a low-privileged local attacker plant an attacker-controlled root certificate in the machine's Trusted Root Certification Authorities store by winning a TOCTOU race during Fiddler's one-time HTTPS-decryption certificate trust workflow. The attacker must already have code execution on the host, the legitimate user must initiate the trust operation and approve the UAC elevation prompt, and the substitution of Fiddler's temporary certificate file must land in the narrow window between write and the elevated TrustCert helper's read. No public exploit code has been identified at time of analysis and the flaw is local-only with no remote vector, so this is a conditional, probabilistic privilege-abuse issue rather than an internet-facing emergency.
Front-end request desynchronization in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a locally positioned, low-privileged actor to send a single malformed request through the proxy's forwarding component and have it split into two requests delivered to the origin server, returning an extra smuggled response on the reused client connection. Exploitation is constrained: it requires local access to the Fiddler proxy (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 3.6), depends on the exact condition of a request carrying both Content-Length and Transfer-Encoding headers combined with connection reuse and pipelining behavior, and is limited to shared or multi-user developer environments rather than production edge deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released fix is v6.0.20262.10021.
HTTP request smuggling in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a low-privileged local user sharing the same Fiddler proxy instance to desynchronize requests and poison responses delivered to other users. Fiddler forwards conflicting multiple Content-Length headers verbatim to the origin while framing the body using only the first value, and because the server connection is returned to Fiddler's pipe pool after reading only the first response, an unread smuggled response stays buffered on the socket and is served to the next session that reuses it. Exploitation is authenticated (CVSS vector PR:L), local-only (AV:L), and high complexity (AC:H), requiring a non-RFC-9110-compliant keep-alive origin server; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Local abuse of privileged IPC in Progress Telerik Fiddler Everywhere before 8.2.0 lets a low-privileged, locally authenticated attacker who can tamper with the application's launch parameters - and then persuade the victim to actually start the app - substitute attacker-controlled UI or settings content for the genuine ones. That foothold can expose OAuth authentication tokens, execute locally reachable programs, or silently rewrite application-generated configuration files, with high confidentiality impact and limited integrity impact but no availability impact. No public exploit identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score of 5.6 reflects the strict prerequisites of local access plus user interaction, making this a developer-workstation-scoped risk rather than an urgent, remotely reachable one.
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.
A crafted XLSX or XLS workbook, or a crafted formula inside one, can terminate or hang the host process that parses it with RadSpreadProcessing or RadSpreadStreamProcessing in Progress Telerik Document Processing Libraries before 2026.3.1027. The root cause is a cluster of resource-consumption defects (CWE-674 uncontrolled recursion, infinite loop, unchecked loop condition, inefficient regular expression) reachable without authentication or user interaction at the library level, giving a high availability-only impact (CVSS 7.5, A:H, no confidentiality or integrity effect). The practical exposure depends on deployment: any application feature that accepts and processes untrusted spreadsheets is exposed, while installations that only process trusted internal documents effectively avoid the remote path; no public exploit code is identified in the available data and the vendor's stated complete fix is upgrading to 2026.3.1027 or later.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows unauthenticated remote attackers to hang or terminate the host process by submitting a crafted PDF to RadPdfProcessing or crafted document text to the AI document summarization and question-answering features (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The flaw is reachable only where an application built on the libraries exposes PDF upload or AI summarization intake to untrusted users; installations that process only trusted internal documents are not realistically exposed, and there is no data disclosure or code execution. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the vendor states that upgrading to version 2026.3.1027 is the only complete fix. This is a genuine but moderate-priority availability issue rather than a high-severity emergency.
Denial of service in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an unauthenticated remote attacker to terminate or hang the host process by supplying a crafted DOCX, DOC, RTF, or HTML document to RadWordsProcessing. The flaw involves uncontrolled recursion, inefficient algorithmic complexity, and infinite-loop conditions during parsing, with impact limited to availability. No public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data.
RadPdfProcessing, the PDF component of Progress Telerik Document Processing Libraries before version 2026.3.1027, performs improper verification of cryptographic signatures and improper certificate validation when validating signed PDFs. Per the vendor CVSS vector the flaw is remotely reachable without authentication or user interaction and yields an integrity-only impact (C:N/I:H/A:N, score 7.5), because a crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid. Exposure is limited to applications that actually call this library to verify PDF signatures and then act on the verification result as a trust decision; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor-published advisory places it on a this-week remediation cadence.
XML external entity injection in Progress Telerik Document Processing Libraries before 2026.3.1027 allows remote unauthenticated attackers to read local files on the server when an application processes or exports a crafted SVG image to PDF. The malicious input uses a nested embedded SVG carrying an external entity reference, and the CVSS 3.1 vector rates confidentiality impact High with no integrity or availability impact. No public exploit was identified at time of analysis, and practical exposure depends on whether the host application renders or PDF-exports untrusted SVG content.
Path traversal in Progress Telerik Document Processing Libraries before 2026.3.1027 allows an authenticated, low-privilege user who can supply arguments to the Convert and Merge AI agent tools to read files outside the configured output directory and to overwrite any of those files that the process account can write. Supplied relative paths resolve against the process's current working directory instead of being confined to the output directory, yielding high confidentiality and limited integrity impact (CVSS 7.1, PR:L). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's complete fix is an update to 2026.3.1027 or later, which puts this in the 'this week' remediation queue rather than an emergency.
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Insufficient access controls in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) allow a remote, authenticated attacker holding only limited management privileges to read security-sensitive information, which can then be used to reach protected resources outside that account's intended scope. The CVE carries a 7.7 score with a scope-changing vector (S:C) because the confidentiality impact crosses a privilege boundary, but exploitation is gated on the attacker already possessing a valid low-privilege management account (PR:L), and no user interaction is required. No public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exposure concentrates in multi-tenant or role-segmented installations, or as a lateral-movement step after an initial account compromise.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Stored cross-site scripting in Progress Telerik Report Server versions prior to 12.2.26.1007 allows an authenticated report author to execute arbitrary script in another user's session by embedding javascript: or vbscript: URLs in report navigation actions or HTML text-box links. When a higher-privilege user, such as an administrator, views the malicious report and triggers the embedded navigation, the script runs in the web report viewer's origin, enabling privilege escalation in multi-user deployments. The vulnerability has a CVSS score of 8.9, requires authentication and user interaction, and no public exploit has been identified at time of analysis.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
Denial of service in Progress Telerik Document Processing's SpreadProcessing library (all versions prior to 2026.3.1006) allows unauthenticated remote attackers to hang an application CPU thread indefinitely by supplying a specifically corrupted XLS spreadsheet for import. The crafted file drives the XLS import routine into an infinite loop that ignores the library's configured import timeout, so the built-in timeout safeguard offers no protection and the affected worker thread becomes permanently unresponsive. Practical exposure depends on whether the host application actually accepts XLS uploads or imports from untrusted sources; no public exploit code or confirmed active exploitation has been identified at time of analysis, and impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the vendor publishing a base score of 7.3.
OS command injection in Progress Software's Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 allows attacker-controlled shell metacharacters embedded in a Swagger/OpenAPI schema name to run as arbitrary OS commands on a developer's workstation, because the derived {fileName} value is interpolated unquoted into the agent's shell-based temporary-file cleanup commands (rm -f / del /Q / rmdir). Exploitation is unauthenticated from a network perspective (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: a developer must load the attacker-supplied API specification into the generator, which is reflected in the UI:R metric and the 9.6 score with Scope:Changed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but a vendor patch (upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 plus the Progress DataDirect Critical Security Alert Bulletin, September 2026) is available.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Privilege escalation in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a local low-privileged attacker replace one of the application's external helper executables with a different, validly signed binary that passes the product's weak publisher-name allow-list check, causing Fiddler to launch attacker-chosen code - including elevated (Administrator) execution for the helper tools that request elevation. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.9), requires write access to the installed helper binaries, and is gated on a user launching the affected tool and approving the elevation prompt without noticing the executable name changed; it is not remotely or unauthenticated exploitable, and there is no public exploit identified at time of analysis. The authoritative assessment rates this a moderate, locally-exploitable privilege-escalation flaw rather than a drop-everything priority, with the UI:R requirement and the need for a pre-existing local foothold being the main limits on real-world abuse.
Progress Software Fiddler Everywhere 8.0.2 ships a local .NET backend (Fiddler.WebUi) that exposes an HTTP and SignalR RPC endpoint on the loopback interface without any authentication, allowing any local user or process on the same machine to call privileged methods, mint OAuth tokens, and export the application's machine-in-the-middle root certificate. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7) and only exploitable while Fiddler Everywhere is installed and running, but it requires no credentials or user interaction once those conditions hold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the practical risk is credential and trust-anchor theft on shared workstations or hosts where untrusted local software can execute.
Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
Path traversal in the RadImageEditor component of Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.3.812) allows unauthenticated remote attackers to read arbitrary files from the server by supplying crafted state values that manipulate the control's image cache lookup. The vulnerability stems from insufficient server-side validation of client-controlled input that determines which file the cache mechanism retrieves, enabling directory traversal beyond the intended image directories. No public exploit has been identified at time of analysis, but the low-complexity unauthenticated attack vector makes this a practical risk for any internet-exposed ASP.NET application using RadImageEditor.
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis.
OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.
Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.
Cryptographic key predictability in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 lets remote unauthenticated attackers forge integrity-protected upload metadata when Telerik.Upload.ConfigurationHashKey is absent and no explicit machineKey is configured, causing the upload handler to fall back to a predictable default key. This forgery capability is not the end goal but a stepping stone: it unlocks further exploit chains (notably the RAU unauthenticated deserialization chain referenced in the vendor KB). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows remote unauthenticated attackers to exploit a timing oracle in RadAsyncUpload's upload metadata processing, recovering protected (encrypted/signed) metadata values through measurable response-time differences during cryptographic validation. The flaw stems from non-constant-time comparison of the metadata's cryptographic integrity, letting an attacker probe validity incrementally. No public exploit was identified at time of analysis, and it is not listed in CISA KEV; EPSS and POC data were not provided.
Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs.
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
SQL injection in Progress Flowmon ADS (Anomaly Detection System) before versions 12.5.6 and 13.0.5 allows a low-privileged authenticated user to read and modify application data by sending specially crafted requests. The CVSS 4.0 base score of 8.7 (High) reflects high confidentiality and integrity impact plus availability impact over the network with only low privileges required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated OS command injection in the API of Progress ADC products - LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF - allows remote attackers to execute arbitrary commands on the appliance by supplying unsanitized input to multiple command endpoints. The flaw carries a CVSS of 9.8 (pre-auth, network-reachable) and publicly available exploit code exists (a GitHub PoC and watchTowr Labs write-up), though EPSS remains low at 0.30% and CISA SSVC currently rates exploitation status as 'none'. Fixed builds (7.2.63.2 and 7.2.54.18) are available from Progress.
Uncontrolled resource allocation in Progress Software MOVEit Automation lets remote unauthenticated attackers exhaust system resources and force a denial-of-service condition against affected instances (all releases before 2025.0.11 and the 2025.1.x line before 2025.1.7). The flaw carries no confidentiality or integrity impact - availability only - and there is no public exploit identified at time of analysis, with EPSS placing exploitation probability at just 0.04% (12th percentile) and CISA SSVC recording no observed exploitation.
Sensitive-data exposure in Progress MOVEit Automation allows remote attackers to retrieve embedded secrets because the product ships with incorrect default permissions (CWE-276), affecting all versions before 2025.0.11 and the 2025.1.x line before 2025.1.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.02%, 7th percentile), and CISA SSVC rates exploitation as none and non-automatable, so despite the high CVSS this is not currently a widespread exploitation risk.
Denial of service in Progress MOVEit Automation before 2025.0.11 and 2025.1.x before 2025.1.7 lets remote unauthenticated attackers exhaust availability by flooding the service with requests that allocate resources without limits or throttling. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%), but the CVSS 7.5 rating reflects a clean network, no-authentication path to disrupting the file-transfer automation engine. Impact is limited to availability - no data confidentiality or integrity loss occurs.
Improper input validation in Progress MOVEit Automation enables authenticated low-privilege attackers to escalate privileges and cause high-impact denial of service across container boundaries. Affecting all versions prior to 2025.1.5, 2025.0.9, and 2024.1.8, this network-accessible vulnerability with low attack complexity allows attackers to disrupt availability system-wide. Progress issued a Critical Security Alert Bulletin addressing this issue alongside CVE-2026-4670 in their April 2026 advisory. No public exploit identified at time of analysis, but the straightforward attack path (AV:N/AC:L/PR:L) and Changed scope indicate significant real-world risk for organizations running unpatched instances.
Authentication bypass in Progress MOVEit Automation allows remote unauthenticated attackers to completely circumvent authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. Affects all versions before 2025.0.9, all 2024.x versions before 2024.1.8, and all versions prior to 2024.0.0. Progress Software has released patches for all supported versions. CVSS 9.8 critical severity with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit or active exploitation confirmed at time of analysis, though the authentication bypass nature and MOVEit's history as a high-value target make this a priority remediation candidate.
Remote code execution in Progress Telerik UI for ASP.NET AJAX via insecure deserialization in the RadFilter control allows unauthenticated remote attackers to execute arbitrary code on the server by tampering with exposed client-side filter state. Affected versions span 2024.4.1114 through 2026.1.421. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis. The CVSS 8.1 (High) reflects network accessibility but 'High' attack complexity (AC:H), indicating successful exploitation requires specific conditions beyond simple network access.
Uncontrolled resource consumption in Progress Telerik UI for AJAX RadAsyncUpload component allows remote unauthenticated attackers to exhaust disk space by uploading files exceeding configured size limits through chunked upload bypass. The vulnerability arises from missing cumulative size validation during chunk reassembly, enabling attackers to circumvent intended upload restrictions. No authentication required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making this exploitable against any internet-facing application using affected versions. Patch available in version 2026.1.421. No CISA KEV listing or public exploit code identified at time of analysis, but low attack complexity and no authentication barrier indicate straightforward exploitation potential.
OS command injection in Progress LoadMaster and related ADC products allows authenticated administrators with 'All' permissions to execute arbitrary commands via malicious WAF rule file uploads. The attacker exploits unsanitized input during the file upload process in the web UI. With CVSS 8.4 and scope change to 'Changed', successful exploitation enables complete system compromise beyond the vulnerable component. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. EPSS data not available for risk assessment.
Command injection in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF allows authenticated administrators with 'VS Administration' privileges to execute arbitrary operating system commands on the appliance via unsanitized input to the 'aclcontrol' API command. CVSS 8.4 reflects high-privilege requirement but scope change indicates container escape or cross-boundary impact. EPSS data not provided. No public exploit identified at time of analysis. Vendor-released patch: version 7.2.63.0 for all affected products per Progress advisory.
OS command injection in Progress LoadMaster, MOVEit WAF, ECS Connections Manager, and Object Scale Connection Manager API allows authenticated attackers with 'All' permissions to execute arbitrary commands on appliances via unsanitized input in the 'killsession' API endpoint. CVSS 8.4 (High) reflects adjacent network access vector and high privileges requirement, limiting exploitation to administrators or compromised admin accounts. CISA SSVC assessment indicates no active exploitation, non-automatable attack, but total technical impact. EPSS data not provided, but privilege requirements significantly reduce real-world attack surface compared to unauthenticated RCE vulnerabilities.
Command injection in Progress LoadMaster and related ADC products allows authenticated attackers with Geo Administration permissions to execute arbitrary OS commands on appliances via the unsanitized 'addcountry' API parameter. Affects LoadMaster, ECS Connections Manager, MOVEit WAF, and Object Scale Connection Manager versions prior to 7.2.63.0. EPSS data unavailable; not listed in CISA KEV. CVSS 8.4 reflects high impact (complete system compromise) but requires adjacent network access and high-privilege authentication, significantly constraining real-world exploitation scenarios. Vendor has released patches addressing all affected products.
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to execute malicious JavaScript in administrator sessions via crafted links. Affected versions: Flowmon 12.x prior to 12.5.8 and 13.x prior to 13.0.6. CVSS 8.5 (High) reflects network-based delivery with low complexity requiring privileged access and user interaction. EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV); SSVC designates exploitation status as 'none' with non-automatable attack requiring user interaction for total technical impact. Vendor Progress Software released patches addressing the XSS flaw.
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (versions 2022.3.1109 up to but not including 2026.3.1015) allows an attacker who can influence the URL of a ToolBar ButtonGroup button to inject extra HTML attributes - including an event handler - and execute JavaScript in a victim's browser when that button is interacted with. The flaw is unauthenticated from the network perspective (CVSS:3.1/AV:N/PR:N) but requires user interaction (UI:R) and is rated high complexity (AC:H) because the payload must break out of an unquoted attribute; impact is scoped to the application's browser context with low confidentiality and integrity effects (C:L/I:L/A:N, base score 4.7). This is a genuine but comparatively low-urgency issue: no public exploit code exists and there is no confirmation of active exploitation (not listed in CISA KEV), and the vendor has released a fix in version 2026.3.1015.
Stored/DOM cross-site scripting in Progress Kendo UI for jQuery (Scheduler widget, versions 2026.3.811 and earlier) allows an attacker who can control a scheduler resource's color value to inject extra HTML attributes - including event handlers - into the quoted event wrapper attributes rendered by the Day, Timeline, Month, and Agenda views, so JavaScript executes in a victim's browser when the affected event is interacted with. Successful exploitation compromises the confidentiality and integrity of data accessible to the host application, though severity is limited by high attack complexity (AC:H), mandatory victim interaction (UI:R), and the practical need for write access to resource data (assessed PR:L; the vendor published PR:N). No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; the vendor-released fix is version 2026.3.1015.
Cross-site scripting (XSS) in the PanelBar component of Progress Kendo UI for jQuery (versions 2019.2.514 through before 2026.3.1015) allows unauthenticated remote attackers who can influence PanelBar item URL values to inject additional HTML attributes, including event handlers, into a single-quoted href attribute, resulting in JavaScript execution in a victim's browser upon interaction with the crafted item. Exploitation requires that the target application binds the PanelBar to a data source with attacker-controllable URLs and that a victim interacts with the item, making it a moderate-severity issue (CVSS 4.7) with high attack complexity. No public exploit code has been identified at time of analysis, and the vulnerability is fully remediated by upgrading to version 2026.3.1015.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Cross-site scripting in the Kendo UI for jQuery FileBrowser and ImageBrowser components (v2023.1.117 through pre-v2026.3.1015) lets a file or directory name containing script-related HTML execute JavaScript in the browser of any user who opens the affected browse dialog, compromising the confidentiality and integrity of data reachable in that application origin. Exploitation is conditional: an attacker must be able to influence the name of a file or directory that the component enumerates (typically via an upload or a shared storage path), and the payload only fires when a victim actually views the FileBrowser or ImageBrowser view - the independent assessment therefore scores this AV:N/AC:L/PR:L/UI:R (6.5) rather than the vendor's PR:N/UI:N vector. Impact is confined to the victim's browser context with no server-side code execution; no public exploit code was identified at time of analysis and there is no CISA KEV listing, but a fixed release (v2026.3.1015) is available.
Moderate-severity cross-site scripting (XSS) in Progress Kendo UI for Vue's chart component (@progress/kendo-vue-charts) versions 2.5.0 through 16.1.x allows an authenticated attacker with low privileges to inject malicious HTML into chart tooltip values, which executes JavaScript when a victim hovers over a data point. The default chart tooltip renders formatted point values as raw HTML without encoding, leading to potential compromise of data confidentiality and integrity. No public exploit identified at time of analysis. Exploitation requires the attacker to influence a string value bound to the chart and the victim to interact with the tooltip (UI:R).
Progress KendoReact's default chart tooltip fails to HTML-encode formatted point values, enabling a low-privileged attacker who can influence chart-bound string data to inject JavaScript that executes when a victim hovers over the affected data point. This stored/influenced XSS affects @progress/kendo-react-charts versions 1.1.0 through 16.1.x and requires user interaction, with a moderate CVSS score of 5.4. No public exploit code or active exploitation is known at this time, and upgrading to 16.2.0 or later eliminates the flaw.
Local privilege abuse in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) lets a low-privileged local attacker plant an attacker-controlled root certificate in the machine's Trusted Root Certification Authorities store by winning a TOCTOU race during Fiddler's one-time HTTPS-decryption certificate trust workflow. The attacker must already have code execution on the host, the legitimate user must initiate the trust operation and approve the UAC elevation prompt, and the substitution of Fiddler's temporary certificate file must land in the narrow window between write and the elevated TrustCert helper's read. No public exploit code has been identified at time of analysis and the flaw is local-only with no remote vector, so this is a conditional, probabilistic privilege-abuse issue rather than an internet-facing emergency.
Front-end request desynchronization in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a locally positioned, low-privileged actor to send a single malformed request through the proxy's forwarding component and have it split into two requests delivered to the origin server, returning an extra smuggled response on the reused client connection. Exploitation is constrained: it requires local access to the Fiddler proxy (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 3.6), depends on the exact condition of a request carrying both Content-Length and Transfer-Encoding headers combined with connection reuse and pipelining behavior, and is limited to shared or multi-user developer environments rather than production edge deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released fix is v6.0.20262.10021.
HTTP request smuggling in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a low-privileged local user sharing the same Fiddler proxy instance to desynchronize requests and poison responses delivered to other users. Fiddler forwards conflicting multiple Content-Length headers verbatim to the origin while framing the body using only the first value, and because the server connection is returned to Fiddler's pipe pool after reading only the first response, an unread smuggled response stays buffered on the socket and is served to the next session that reuses it. Exploitation is authenticated (CVSS vector PR:L), local-only (AV:L), and high complexity (AC:H), requiring a non-RFC-9110-compliant keep-alive origin server; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Local abuse of privileged IPC in Progress Telerik Fiddler Everywhere before 8.2.0 lets a low-privileged, locally authenticated attacker who can tamper with the application's launch parameters - and then persuade the victim to actually start the app - substitute attacker-controlled UI or settings content for the genuine ones. That foothold can expose OAuth authentication tokens, execute locally reachable programs, or silently rewrite application-generated configuration files, with high confidentiality impact and limited integrity impact but no availability impact. No public exploit identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score of 5.6 reflects the strict prerequisites of local access plus user interaction, making this a developer-workstation-scoped risk rather than an urgent, remotely reachable one.
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.