# Progress vulnerabilities & exploitation > As of 2026-11-07, Threadlinqs tracks 14 Progress CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 4 tracked threat campaigns. **Data as of:** 2026-11-07 ## Exploitation timeline Threadlinqs has recorded 14 Progress CVEs published between 2026-04-15 and 2026-10-15. The busiest month was 2026-10 (12 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 14 of 14 tracked Progress CVEs. - [CVE-2026-2701](https://intel.threadlinqs.com/cve/CVE-2026-2701) — CRITICAL 9.1 · EPSS 3.4% · 2026-04-02 - [CVE-2026-2699](https://intel.threadlinqs.com/cve/CVE-2026-2699) — CRITICAL 9.8 · EPSS 3.2% · 2026-04-02 - [CVE-2026-89068](https://intel.threadlinqs.com/cve/CVE-2026-89068) — HIGH 8.1 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89067](https://intel.threadlinqs.com/cve/CVE-2026-89067) — HIGH 8.8 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89071](https://intel.threadlinqs.com/cve/CVE-2026-89071) — HIGH 7.5 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89076](https://intel.threadlinqs.com/cve/CVE-2026-89076) — HIGH 7.2 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89074](https://intel.threadlinqs.com/cve/CVE-2026-89074) — HIGH 7.5 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89077](https://intel.threadlinqs.com/cve/CVE-2026-89077) — HIGH 7.5 · EPSS 0.5% · 2026-10-14 - [CVE-2026-89070](https://intel.threadlinqs.com/cve/CVE-2026-89070) — HIGH 7.5 · EPSS 0.4% · 2026-10-14 - [CVE-2026-89069](https://intel.threadlinqs.com/cve/CVE-2026-89069) — HIGH 8 · EPSS 0.4% · 2026-10-14 - [CVE-2026-89073](https://intel.threadlinqs.com/cve/CVE-2026-89073) — HIGH 7.5 · EPSS 0.4% · 2026-10-14 - [CVE-2026-89072](https://intel.threadlinqs.com/cve/CVE-2026-89072) — HIGH 7.5 · EPSS 0.2% · 2026-10-14 - [CVE-2026-89075](https://intel.threadlinqs.com/cve/CVE-2026-89075) — HIGH 7.3 · EPSS 0.2% · 2026-10-14 - [CVE-2026-87093](https://intel.threadlinqs.com/cve/CVE-2026-87093) — HIGH 8.8 · EPSS 0.2% · 2026-10-14 ## Products affected Threadlinqs normalises CPE and CNA product records across all 14 CVEs; 2 distinct Progress products are affected. The most frequently affected: - MOVEit Transfer — 12 CVEs - ShareFile Storage Zones Controller — 2 CVEs ## Threat activity 4 tracked threat campaigns reference Progress products or exploit Progress CVEs: - [Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)](https://intel.threadlinqs.com/threat/TL-2026-5508) — HIGH — 2026-11-07 - [Progress MOVEit Transfer: 12 vulnerabilities incl. authentication bypass and privilege escalation (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068 and 9 more)](https://intel.threadlinqs.com/threat/TL-2026-3821) — HIGH — 2026-10-17 - [Progress ShareFile Pre-Auth RCE Chain via Authentication Bypass and Webshell Upload (CVE-2026-2699 & CVE-2026-2701)](https://intel.threadlinqs.com/threat/TL-2026-0317) — CRITICAL — 2026-04-04 - [Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (CVE-2026-2699, CVE-2026-2701)](https://intel.threadlinqs.com/threat/TL-2026-1513) — CRITICAL — 2026-04-02 ## How to prioritise Progress patching This order follows the data Threadlinqs holds for Progress, not a generic severity checklist: - No Progress CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2026-2701](https://intel.threadlinqs.com/cve/CVE-2026-2701) (3.4%), [CVE-2026-2699](https://intel.threadlinqs.com/cve/CVE-2026-2699) (3.2%), [CVE-2026-89068](https://intel.threadlinqs.com/cve/CVE-2026-89068) (0.5%). - 2 CVEs score Critical and 12 High on CVSS v3 (maximum 9.8, average 8); sequence these after KEV and high-EPSS items. - 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/progress All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs for threats exploiting Progress products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp