23
CVEs
1
Critical
18
High
0
KEV
1
PoC
2
Unpatched C/H
91.3%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
18
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-80462 | Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis. | CRITICAL | 10.0 | 0.3% | 50 |
PoC
|
| CVE-2026-9272 | SQL injection in Progress Flowmon ADS (Anomaly Detection System) before versions 12.5.6 and 13.0.5 allows a low-privileged authenticated user to read and modify application data by sending specially crafted requests. The CVSS 4.0 base score of 8.7 (High) reflects high confidentiality and integrity impact plus availability impact over the network with only low privileges required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-8079 | Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High). | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-59686 | OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis. | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-59687 | OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis. | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-59688 | We need to produce a JSON object with all the specified fields. Let's analyze the input data: CVE ID: CVE-2026-59688 Description: "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise." CVSS Score: 8.4 CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CWE: CWE-78 Multi-source intelligence: - Reported by: ProgressSoftware (so vendor advisory) - CPEs: listed for all four products with wildcard versions (*) - Tags: Command Injection, Loadmaster, etc. - References: an advisory from Progress community. Other fields: EPSS? Not provided. KEV? Not mentioned. Patch availability? The advisory link likely contains info but not provided here. The description and CVSS vector is given. No explicit patch version mentioned; the advisory is a bulletin, so we can infer that patches may be available. For remediation, we need to pull the exact fix version if possible. Since the input doesn't include the advisory content, we can't specify the exact fixed version. We'll state that the vendor advisory provides remediation details and recommend consulting it. However, we should check if the advisory link title suggests any version: "LoadMaster Critical Security Bulletin July 2026 ..." and also includes other CVEs. It likely includes patched versions. We'll note that patches are available in the advisory. For remediation, we'll say "Upgrade to the fixed version as per the vendor advisory at [link]." Risk assessment: CVSS 8.4, vector is AV:A (adjacent network), AC:L, PR:H (high privileges), UI:N, S:C (scope changed), C:H/I:H/A:H. This means adjacent network attack vector, low complexity, high privileges required, scope changed, high impact all. EPSS missing. KEV not listed. No P | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-13186 | Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | HIGH | 8.1 | 0.7% | 41 |
|
| CVE-2026-13181 | Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs. | HIGH | 8.1 | 0.6% | 41 |
|
| CVE-2026-13185 | Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided. | HIGH | 8.1 | 0.6% | 41 |
|
| CVE-2026-13190 | Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching. | HIGH | 8.1 | 0.6% | 41 |
|
| CVE-2026-13187 | Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized. | HIGH | 8.1 | 0.4% | 41 |
|
| CVE-2026-19219 | Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score. | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-59690 | Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-59689 | Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis. | HIGH | 8.0 | 0.2% | 40 |
|
| CVE-2026-13182 | Information disclosure in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote unauthenticated attackers abuse the RadAsyncUpload control's client-state handling as a cryptographic oracle. Because the server distinguishes decryption failures from invalid-JSON parse failures, an attacker can iteratively probe the encrypted rauPostData token and recover protected metadata values. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.5 | 0.5% | 38 |
|