Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress patched 12 MOVEit Transfer flaws, including authentication bypass, with no exploitation reported.
68
Vendor
Progress Software
- Mentions · 7d0
- Mentions · 30d4
- All mentions9
- First seenSep 2, 2026
- Last mentioned14d ago
Timeline
9 articles · newest firstTwo Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Progress fixed 31 MarkLogic Server flaws, including critical bugs that can give delegated managers persistent admin control.
64
Progress security advisory (AV26-1005)
Canada's Cyber Centre warns of CVE-2026-91140 in Progress ARCGenAI-Generator before version 2.1.
28
Progress security advisory (AV26-999)
Canada's Cyber Centre urges updates for Progress Fiddler Classic and the Sitefinity Next.js SDK.
42
Progress security advisory (AV26-915)
Canadian Cyber Centre advisory AV26-915 warns of a vulnerability in Progress Software Chef Automate prior to 4.13.520.
25
ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability
ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.
28
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
60
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works
Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.
25
Progress Software security advisory (AV26-875)
Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.
30
Related CVEs
by mentions- CVE-2023-34362100%9.8Unauthenticated SQL Injection in Progress MOVEit Transfer
- Privilege Escalation to Persistent Admin in Progress MarkLogic Server
- LDAP authentication bypass in Progress MOVEit Transfer
- SQL Injection in Progress MOVEit Transfer Custom Reports
- Authenticated SSRF in Progress MarkLogic Server 12.x and 11.x
- CVE-2026-19219<1%8.1Potential RCE in Progress Telerik UI for ASP.NET AJAX via dialog parameter tampering
- CVE-2026-13185<1%8.1In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize…
- OIDC capture-replay auth bypass in Progress MOVEit Transfer
- Predictable CSRF tokens in Progress MarkLogic Query Console
- Cross-site scripting in Progress MOVEit Transfer Ad Hoc
Appears with
- Canadian Centre for Cyber Securityorganization · 4
- MOVEit Transferproduct · 2
- Progress Softwareorganization · 2
- Telerikvendor · 2
- Telerik UI for ASP.NET AJAXproduct · 2
- Cl0pthreat actor · 2
- Cyblevendor · 1
- GoAnywhere MFTproduct · 1
- Autonomous REST Connectorproduct · 1
- Bugcrowdorganization · 1
- CODE WHITEorganization · 1
- RadPersistenceManagerproduct · 1
- IONIXorganization · 1
- RadAsyncUploadproduct · 1
- Zero Day Initiativeorganization · 1
- Telerik Fiddler Classicproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.