Progress

Products

Exploited and recent CVEs

• CVE-2026-89077 High 7.5 MOVEit Transfer Identity validation flaw in SFTP authentication 0.5%
• CVE-2026-89076 High 7.2 MOVEit Transfer SQL injection in custom reporting 0.5%
• CVE-2026-89075 High 7.3 MOVEit Transfer Local Disclosure of Session Information Vulnerability 0.2%
• CVE-2026-89074 High 7.5 MOVEit Transfer Email MFA Bypass 0.5%
• CVE-2026-89073 High 7.5 MOVEit Transfer Access restriction bypass in OAuth authentication 0.4%
• CVE-2026-89072 High 7.5 MOVEit Transfer Authorization Flaw in Certificate Management 0.2%
• CVE-2026-89071 High 7.5 MOVEit Transfer LDAP injection in certificate-based authentication 0.5%
• CVE-2026-89070 High 7.5 MOVEit Transfer OIDC Authentication Replay Vulnerability 0.4%
• CVE-2026-89069 High 8.0 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages 0.4%
• CVE-2026-89068 High 8.1 MOVEit Transfer Authentication bypass in LDAP sign-on 0.5%
• CVE-2026-89067 High 8.8 MOVEit Transfer Secure Messaging Authentication Bypass 0.5%
• CVE-2026-87093 High 8.8 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation 0.2%
• CVE-2026-93695 High 7.4 Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService 0.2%
• CVE-2026-93694 Medium 4.0 Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller <0.1%
• CVE-2026-93693 Medium 6.5 Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller 0.2%
• CVE-2026-16137 High 7.2 Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller 0.7%
• CVE-2026-16138 High 8.0 Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service 0.8%
• CVE-2026-16139 High 7.2 Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution 0.9%
• CVE-2026-15968 High 7.1 Stored XSS vulnerability in MOVEit Transfer 0.3%
• CVE-2026-15967 High 7.5 MOVEit Transfer refresh-token processing does not enforce updated account restrictions 0.4%
• CVE-2026-15966 High 7.5 Improper CORS handling in MOVEit Transfer 0.4%
• CVE-2026-10697 High 7.5 MFA Bypass in MOVEit Transfer 0.6%
• CVE-2026-15724 High 8.7 Path traversal in Progress ShareFile Storage Zones Controller (SZC) 0.5%
• CVE-2026-8801 Low 3.5 File Extension Restriction Bypass in MOVEit Transfer 0.5%
• CVE-2026-8800 Low 2.7 Cross-Org External Token Metadata accessible to AuditUser role 0.4%
• CVE-2026-8651 Low 3.7 IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer 0.4%
• CVE-2026-8650 Medium 4.5 Authenticated Path Traversal allows MOVEit admins to view arbitrary system files 0.6%
• CVE-2026-8649 Medium 6.4 Institution scope bypass vulnerability in custom reports 0.5%
• CVE-2026-11903 High 8.0 Stored XSS in MOVEit Transfer Ad Hoc module 0.4%
• CVE-2026-10699 High 7.5 Memory leak in SFTP service can result in a denial of service in MOVEit Transfer 0.5%