# Progress Software vulnerabilities Source: https://junglewise.ai/threats/vendors/progress-software Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/progress-software.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 48 vulnerabilities in Progress Software: 14 in the last 7 days and 31 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124693, was published on 11 November 2026. 24 vulnerabilities in the last four weeks, up 1100% on the four before (2). 6 critical against 1. 5 technologies have a page of their own. ## Counts - Last 7 days: 14 - Last 30 days: 29 - Last 90 days: 31 - All time: 48 (7 critical, 0 exploited in the wild) ## About Progress Software An American software company that develops tools for application development, data connectivity, and digital experience management. ## Latest Progress Software vulnerabilities - [CVE-2026-124693: Kendo UI for jQuery PivotGrid cross-site scripting in axis field names](https://junglewise.ai/threats/cve-2026-124693-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-115341: Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer](https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer) (high, CVSS 7.7, published 9 Nov 2026) - [CVE-2026-115340: Progress Software WS_FTP Server sensitive data exposure in temp file](https://junglewise.ai/threats/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-115339: Progress Software WS_FTP Server denial of service via insufficient resource limits](https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-115336: Progress WS_FTP Server incorrect quota accounting](https://junglewise.ai/threats/cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server) (medium, CVSS 6.5, published 9 Nov 2026) - [CVE-2026-106144: Progress Kendo UI Angular prototype pollution in Scheduler](https://junglewise.ai/threats/cve-2026-106144-prototype-pollution-in-the-scheduler-component-progress-kendo) (medium, CVSS 4.1, published 6 Nov 2026) - [CVE-2026-106143: Progress Kendo UI for Vue Editor cross-site scripting](https://junglewise.ai/threats/cve-2026-106143-cross-site-scripting-xss-in-the-editor-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106142: Progress KendoReact Editor cross-site scripting](https://junglewise.ai/threats/cve-2026-106142-cross-site-scripting-xss-in-the-editor-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106141: Progress Kendo UI for Angular Editor XSS via unsafe URL](https://junglewise.ai/threats/cve-2026-106141-cross-site-scripting-xss-in-the-editor-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106136: Progress KendoReact Chat component cross-site scripting](https://junglewise.ai/threats/cve-2026-106136-cross-site-scripting-xss-in-the-chat-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106135: Progress Kendo UI for Angular XSS in Chat component](https://junglewise.ai/threats/cve-2026-106135-cross-site-scripting-xss-in-the-chat-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106134: Progress KendoReact Menu cross-site scripting](https://junglewise.ai/threats/cve-2026-106134-cross-site-scripting-xss-in-the-menu-component-progress-kendo) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-106128: Progress Kendo UI for Vue prototype pollution in field path processing](https://junglewise.ai/threats/cve-2026-106128-prototype-pollution-in-progress-kendo-vue-common-in-progress) (medium, CVSS 4.1, published 6 Nov 2026) - [CVE-2026-106127: Progress KendoReact prototype pollution in setter utility](https://junglewise.ai/threats/cve-2026-106127-prototype-pollution-in-the-setter-utility-progress-kendo-react) (medium, CVSS 4.1, published 6 Nov 2026) - [CVE-2026-90872: Progress Software WS_FTP Server code injection in Manager web console](https://junglewise.ai/threats/cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated) (medium, CVSS 6.6, published 29 Oct 2026) - [CVE-2026-90871: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90871-improper-limitation-of-a-pathname-to-a-restricted-directory-in) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-90870: Progress WS_FTP Server resource exhaustion in Ad Hoc Transfer](https://junglewise.ai/threats/cve-2026-90870-a-missing-release-of-backend-receiver-sessions-in-the-ad-hoc) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-90869: Progress WS_FTP Server SSH service DoS](https://junglewise.ai/threats/cve-2026-90869-a-remote-attacker-who-knows-a-valid-account-s-enrolled-ssh-public) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-90868: Progress Software WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-90867: Progress WS_FTP Server improper access control in Web Admin console](https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-90866: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90865: Progress WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9, published 29 Oct 2026) - [CVE-2026-90864: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90863: Progress WS_FTP Server missing authorization in admin interface](https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90862: Progress Software WS_FTP Server multi-factor authentication bypass](https://junglewise.ai/threats/cve-2026-90862-improper-authentication-in-the-web-transfer-module-of-progress) (medium, CVSS 4.3, published 29 Oct 2026) ## Most severe Progress Software vulnerabilities - [CVE-2026-84295: Progress Software WS_FTP Server authentication bypass](https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server) (critical, CVSS 10, published 29 Oct 2026) - [CVE-2026-90868: Progress Software WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-91140: Progress Autonomous REST Connector command injection in file cleanup](https://junglewise.ai/threats/cve-2026-91140-an-os-command-injection-vulnerability-in-the-shell-based) (critical, CVSS 9.6, published 6 Oct 2026) - [CVE-2026-90866: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90864: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90863: Progress WS_FTP Server missing authorization in admin interface](https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90865: Progress WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9, published 29 Oct 2026) - [CVE-2026-90867: Progress WS_FTP Server improper access control in Web Admin console](https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-13190: Progress Telerik UI for ASP.NET AJAX deserialization in PersistenceFramework](https://junglewise.ai/threats/cve-2026-13190-progress-telerik-ui-for-asp-net-ajax-deserialization-in) (high, CVSS 8.1, published 22 Jul 2026) - [CVE-2026-13187: Progress Telerik UI for ASP.NET AJAX unsafe reflection in DialogHandler](https://junglewise.ai/threats/cve-2026-13187-progress-telerik-ui-for-asp-net-ajax-unsafe-reflection-in) (high, CVSS 8.1, published 22 Jul 2026) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up 1100% on the four before (2). 6 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 1 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 15 | 6 | 0 | | 2 Nov 2026 | 9 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Progress Software technologies - [Progress Software WS FTP Server](https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server): 19 vulnerabilities - [Progress Software UI for ASP.NET AJAX](https://junglewise.ai/threats/technologies/ui-for-asp-net-ajax): 9 vulnerabilities - [Progress Software KendoReact](https://junglewise.ai/threats/technologies/kendoreact): 4 vulnerabilities - [Progress Software MOVEit Automation](https://junglewise.ai/threats/technologies/moveit-automation): 4 vulnerabilities - [Progress Software Kendo UI for Angular](https://junglewise.ai/threats/technologies/kendo-ui-for-angular): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progress Software vulnerabilities", https://junglewise.ai/threats/vendors/progress-software, 11 November 2026.