VendorsEnterprise apps
Progress Software
Progress Software makes the MOVEit and WS_FTP file transfer products, WhatsUp Gold network monitoring, Kemp LoadMaster load balancers, Sitefinity and the Telerik developer tools.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 4 Jun 2026
- Incidents on record
- 3
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
79 range 72–86rank 2 of 20
Medium confidence, 21 private reports
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: B (79). Median 98 days from private report to ZDI's public advisory (21 cases). 4 of 21 took longer than ZDI's 120-day deadline.
- 3 of 3 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessNo machine-readable advisory feed listed426 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 98 days from private report to ZDI's public advisory (21 cases)79B21 cases, medium confidence, weight 100%
Response fingerprint
Compressed time scale
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 3: n-days, unreviewed timelines and end-of-life products
- 4 Jun 2026Progress Kemp LoadMaster pre-authentication OS command injection (LoadMaster Critical Security Bulletin June 2026)Not graded: n-day
- 25 Jun 2024Progress WhatsUp Gold unauthenticated remote code execution (GetFileWithoutZip, June 2024 bulletin)Not graded: n-day
- 7 Feb 2024Progress Kemp LoadMaster unauthenticated OS command injection via the management APINot graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
3 in 24 months, 0 with known ransomware use, 0% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 4 Jun 2026 | Progress Kemp LoadMaster pre-authentication OS command injection (LoadMaster Critical Security Bulletin June 2026)CVE-2026-8037 | 9.6 | same day | same day | same day | Fixed | Not graded: n-day |
| 25 Jun 2024 | Progress WhatsUp Gold unauthenticated remote code execution (GetFileWithoutZip, June 2024 bulletin)CVE-2024-4885 | 9.8 | 0h | 0h | 0h | Fixed | Not graded: n-day |
| 7 Feb 2024 | Progress Kemp LoadMaster unauthenticated OS command injection via the management APICVE-2024-1212 | 10.0 | same day | same day | same day | Fixed | Not graded: n-day |
Private reports
Median 98 days, 19% over 120 days, 0 published unpatched
Bugs reported privately to Progress Software by ZDI or Project Zero.
120-day deadlinemedian 98d
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 9 Sep 2026 | ZDI-26-646CVE-2026-8037 | Kemp LoadMaster | 126to publication | Yes |
| 29 Jul 2026 | ZDI-26-481CVE-2026-59690 | Kemp LoadMaster | 44to publication | Yes |
| 29 Jul 2026 | ZDI-26-482CVE-2026-59689 | Kemp LoadMaster | 57to publication | Yes |
| 9 Jun 2026 | ZDI-26-340, ZDI-26-341, ZDI-26-342CVE-2026-8037 | Kemp LoadMaster | 55to publication | Yes |
| 21 May 2026 | ZDI-26-318, ZDI-26-319CVE-2026-3517, CVE-2026-3518 | Kemp LoadMaster | 87to publication | Yes |
| 2 Feb 2026 | ZDI-26-051, ZDI-26-052, ZDI-26-053, ZDI-26-055CVE-2025-13444, CVE-2025-13447 | Kemp LoadMaster | 96to publication | Yes |
| 2 Feb 2026 | ZDI-26-054CVE-2025-13447 | Kemp LoadMaster | 110to publication | Yes |
| 18 Mar 2025 | ZDI-25-151CVE-2025-1758 | Kemp LoadMaster | 125to publication | Yes |
| 12 Dec 2024 | ZDI-24-1684, ZDI-24-1685, ZDI-24-1686, ZDI-24-1687CVE-2024-46905, CVE-2024-46906, CVE-2024-46907, CVE-2024-46908 | WhatsUp Gold | 120to publication | Yes |
| 6 Dec 2024 | ZDI-24-1645CVE-2024-46909 | WhatsUp Gold | 122to publication | Yes |
Show all 21 private reports
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 18 Nov 2024 | ZDI-24-518, ZDI-24-884, ZDI-24-886, ZDI-24-888, ZDI-24-889, ZDI-24-890, ZDI-24-892, ZDI-24-893, ZDI-24-1512CVE-2024-4357, CVE-2024-4883, CVE-2024-4885, CVE-2024-5009, CVE-2024-5013, CVE-2024-5015, CVE-2024-5019, CVE-2024-7763 | Telerik Reporting; WhatsUp Gold | 208to publication | Yes |
| 29 Aug 2024 | ZDI-24-1187CVE-2024-6672 | WhatsUp Gold | 69to publication | Yes |
| 29 Aug 2024 | ZDI-24-1185, ZDI-24-1186CVE-2024-6670, CVE-2024-6671 | WhatsUp Gold | 99to publication | Yes |
| 29 Aug 2024 | ZDI-24-1184CVE-2024-7744 | WS_FTP | 106to publication | Yes |
| 3 Jul 2024 | ZDI-24-891CVE-2024-5016 | WhatsUp Gold | 68to publication | Yes |
| 3 Jul 2024 | ZDI-24-402, ZDI-24-403, ZDI-24-561, ZDI-24-894CVE-2024-1800, CVE-2024-1856, CVE-2024-4358, CVE-2024-4884 | Telerik Reporting; Telerik Report Server; WhatsUp Gold | 69to publication | Yes |
| 3 Jul 2024 | ZDI-24-895CVE-2024-5008 | WhatsUp Gold | 91to publication | Yes |
| 3 Jul 2024 | ZDI-24-885CVE-2024-5018 | WhatsUp Gold | 98to publication | Yes |
| 3 Jul 2024 | ZDI-24-887CVE-2024-5014 | WhatsUp Gold | 118to publication | Yes |
| 29 May 2024 | ZDI-24-516, ZDI-24-517CVE-2024-4561, CVE-2024-4562 | WhatsUp Gold | 98to publication | Yes |
| 25 Apr 2024 | ZDI-24-401CVE-2024-1801 | Telerik Reporting | 71to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Progress Software's own alerts
- EmailProgress Trust Center (Conveyor) subscriptionSign up for the vendor’s security notification emails.
- XProgress on XFollow the account and turn on notifications.
- BlogProgress blog: Security and ComplianceSubscribe to the security blog.
- Advisory pageProgress Community product security notices (knowledge base)Check the advisory page. It has no push channel.
- Advisory pageProgress Trust CenterCheck the advisory page. It has no push channel.
- Advisory pageTelerik knowledge base security articlesCheck the advisory page. It has no push channel.
Grade not rated.