37
CVEs
3
Critical
30
High
1
KEV
2
PoC
9
Unpatched C/H
75.7%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
30
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8037 | Unauthenticated OS command injection in the API of Progress ADC products - LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF - allows remote attackers to execute arbitrary commands on the appliance by supplying unsanitized input to multiple command endpoints. The flaw carries a CVSS of 9.8 (pre-auth, network-reachable) and publicly available exploit code exists (a GitHub PoC and watchTowr Labs write-up), though EPSS remains low at 0.30% and CISA SSVC currently rates exploitation status as 'none'. Fixed builds (7.2.63.2 and 7.2.54.18) are available from Progress. | CRITICAL | 9.8 | 0.3% | 119 |
KEV
PoC
No patch
|
| CVE-2026-4670 | Authentication bypass in Progress MOVEit Automation allows remote unauthenticated attackers to completely circumvent authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. Affects all versions before 2025.0.9, all 2024.x versions before 2024.1.8, and all versions prior to 2024.0.0. Progress Software has released patches for all supported versions. CVSS 9.8 critical severity with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit or active exploitation confirmed at time of analysis, though the authentication bypass nature and MOVEit's history as a high-value target make this a priority remediation candidate. | CRITICAL | 9.8 | 0.1% | 54 |
|
| CVE-2026-80462 | Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis. | CRITICAL | 10.0 | 0.3% | 50 |
PoC
|
| CVE-2026-9272 | SQL injection in Progress Flowmon ADS (Anomaly Detection System) before versions 12.5.6 and 13.0.5 allows a low-privileged authenticated user to read and modify application data by sending specially crafted requests. The CVSS 4.0 base score of 8.7 (High) reflects high confidentiality and integrity impact plus availability impact over the network with only low privileges required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-8079 | Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High). | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-5174 | Improper input validation in Progress MOVEit Automation enables authenticated low-privilege attackers to escalate privileges and cause high-impact denial of service across container boundaries. Affecting all versions prior to 2025.1.5, 2025.0.9, and 2024.1.8, this network-accessible vulnerability with low attack complexity allows attackers to disrupt availability system-wide. Progress issued a Critical Security Alert Bulletin addressing this issue alongside CVE-2026-4670 in their April 2026 advisory. No public exploit identified at time of analysis, but the straightforward attack path (AV:N/AC:L/PR:L) and Changed scope indicate significant real-world risk for organizations running unpatched instances. | HIGH | 7.7 | 0.1% | 44 |
|
| CVE-2026-3692 | Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-59686 | OS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges and adjacent network access to execute arbitrary commands through the management interface, leading to full system compromise. No active exploitation or publicly available exploit has been reported at the time of analysis. | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-59687 | OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis. | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-59688 | We need to produce a JSON object with all the specified fields. Let's analyze the input data: CVE ID: CVE-2026-59688 Description: "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise." CVSS Score: 8.4 CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CWE: CWE-78 Multi-source intelligence: - Reported by: ProgressSoftware (so vendor advisory) - CPEs: listed for all four products with wildcard versions (*) - Tags: Command Injection, Loadmaster, etc. - References: an advisory from Progress community. Other fields: EPSS? Not provided. KEV? Not mentioned. Patch availability? The advisory link likely contains info but not provided here. The description and CVSS vector is given. No explicit patch version mentioned; the advisory is a bulletin, so we can infer that patches may be available. For remediation, we need to pull the exact fix version if possible. Since the input doesn't include the advisory content, we can't specify the exact fixed version. We'll state that the vendor advisory provides remediation details and recommend consulting it. However, we should check if the advisory link title suggests any version: "LoadMaster Critical Security Bulletin July 2026 ..." and also includes other CVEs. It likely includes patched versions. We'll note that patches are available in the advisory. For remediation, we'll say "Upgrade to the fixed version as per the vendor advisory at [link]." Risk assessment: CVSS 8.4, vector is AV:A (adjacent network), AC:L, PR:H (high privileges), UI:N, S:C (scope changed), C:H/I:H/A:H. This means adjacent network attack vector, low complexity, high privileges required, scope changed, high impact all. EPSS missing. KEV not listed. No P | HIGH | 8.4 | 0.7% | 43 |
|
| CVE-2026-2737 | Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to execute malicious JavaScript in administrator sessions via crafted links. Affected versions: Flowmon 12.x prior to 12.5.8 and 13.x prior to 13.0.6. CVSS 8.5 (High) reflects network-based delivery with low complexity requiring privileged access and user interaction. EPSS score of 0.05% (15th percentile) indicates minimal observed exploitation activity. No active exploitation confirmed (not in CISA KEV); SSVC designates exploitation status as 'none' with non-automatable attack requiring user interaction for total technical impact. Vendor Progress Software released patches addressing the XSS flaw. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2026-3517 | Command injection in Progress LoadMaster and related ADC products allows authenticated attackers with Geo Administration permissions to execute arbitrary OS commands on appliances via the unsanitized 'addcountry' API parameter. Affects LoadMaster, ECS Connections Manager, MOVEit WAF, and Object Scale Connection Manager versions prior to 7.2.63.0. EPSS data unavailable; not listed in CISA KEV. CVSS 8.4 reflects high impact (complete system compromise) but requires adjacent network access and high-privilege authentication, significantly constraining real-world exploitation scenarios. Vendor has released patches addressing all affected products. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-3518 | OS command injection in Progress LoadMaster, MOVEit WAF, ECS Connections Manager, and Object Scale Connection Manager API allows authenticated attackers with 'All' permissions to execute arbitrary commands on appliances via unsanitized input in the 'killsession' API endpoint. CVSS 8.4 (High) reflects adjacent network access vector and high privileges requirement, limiting exploitation to administrators or compromised admin accounts. CISA SSVC assessment indicates no active exploitation, non-automatable attack, but total technical impact. EPSS data not provided, but privilege requirements significantly reduce real-world attack surface compared to unauthenticated RCE vulnerabilities. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-3519 | Command injection in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF allows authenticated administrators with 'VS Administration' privileges to execute arbitrary operating system commands on the appliance via unsanitized input to the 'aclcontrol' API command. CVSS 8.4 reflects high-privilege requirement but scope change indicates container escape or cross-boundary impact. EPSS data not provided. No public exploit identified at time of analysis. Vendor-released patch: version 7.2.63.0 for all affected products per Progress advisory. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-4048 | OS command injection in Progress LoadMaster and related ADC products allows authenticated administrators with 'All' permissions to execute arbitrary commands via malicious WAF rule file uploads. The attacker exploits unsanitized input during the file upload process in the web UI. With CVSS 8.4 and scope change to 'Changed', successful exploitation enables complete system compromise beyond the vulnerable component. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. EPSS data not available for risk assessment. | HIGH | 8.4 | 0.1% | 42 |
No patch
|