Exploitation timeline
Threadlinqs has recorded 8 Progress Software CVEs published between and . The busiest month was 2026-07 (4 new CVEs). 2 of them (25%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 8 of 8 tracked Progress Software CVEs.
- CVE-2024-1212critical 10KEVEPSS 95.4%
- CVE-2026-8037critical 9.6KEVEPSS 77.4%
- CVE-2026-4670critical 9.8EPSS 0.6%
- CVE-2026-13181high 8.1EPSS 0.5%
- CVE-2026-5174high 7.7EPSS 0.5%
- CVE-2026-13183high 7.5EPSS 0.4%
- CVE-2026-13182high 7.5EPSS 0.3%
- CVE-2026-13184high 7.5EPSS 0.3%
Products affected
Threadlinqs normalises CPE and CNA product records across all 8 CVEs; 6 distinct Progress Software products are affected. The most frequently affected:
- Telerik UI for ASP.NET AJAX 4 CVEs
- LoadMaster 2 CVEs
- MOVEit Automation 2 CVEs
- ECS Connections Manager 1 CVE
- MOVEit WAF 1 CVE
- Object Scale Connection Manager 1 CVE
Threat activity
12 tracked threat campaigns reference Progress Software products or exploit Progress Software CVEs:
- Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)HIGH
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS ServersCRITICAL
- Telerik UI for ASP.NET AJAX — Padding Oracle Chained to Unauthenticated Deserialization RCE (CVE-2026-13181–13184)HIGH
- Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web serversHIGH
- Progress ShareFile Zero-Day Path Traversal Flaw Forces Storage Zone Controller ShutdownHIGH
- CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds ReadCRITICAL
- CVE-2026-8037: Unauthenticated OS Command Injection in Progress Kemp LoadMaster via Uninitialized Heap in escape_quotes() (CVSS 9.6-9.8, Active Exploitation)CRITICAL
- CVE-2026-8037: Pre-Auth Command Injection RCE in Progress Kemp LoadMaster via Uninitialized-Heap escape_quotes() Flaw on /accessv2CRITICAL
- Progress MOVEit Automation Critical Pre-Auth Bypass and Privilege Escalation (CVE-2026-4670, CVE-2026-5174)CRITICAL
- APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic TargetingCRITICAL
- Progress ShareFile Pre-Auth RCE Chain via Authentication Bypass and Webshell Upload (CVE-2026-2699 & CVE-2026-2701)CRITICAL
- Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (CVE-2026-2699, CVE-2026-2701)CRITICAL
Threat actors targeting Progress Software
Named threat actors attributed to campaigns that involve Progress Software products or CVEs, with the number of linked campaigns:
How to prioritise Progress Software patching
This order follows the data Threadlinqs holds for Progress Software, not a generic severity checklist:
- 2 of 8 Progress Software CVEs (25%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2024-1212, CVE-2026-8037.
- Outside KEV, the highest EPSS scores are CVE-2026-4670 (0.6%), CVE-2026-13181 (0.5%), CVE-2026-5174 (0.5%).
- 3 CVEs score Critical and 5 High on CVSS v3 (maximum 10, average 8.5); sequence these after KEV and high-EPSS items.
- 3 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.