The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server
through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile()
methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated
privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
CVE-2026-2737 is a high-severity cross-site scripting (XSS) vulnerability in Progress Software Flowmon versions prior to 12.5.8 and 13.0.6. It allows an attacker to craft a malicious link that, if clicked by an administrator, can trigger unintended actions within their authenticated web session. This vulnerability requires user interaction and low privileges but can lead to high impact on confidentiality, integrity, and availability. No official patch information is provided in the available data.
CVE-2026-3692 is a high-severity OS command injection vulnerability in Progress Software Flowmon versions prior to 12.5.8. It allows an authenticated low-privileged user to craft a malicious request during report generation that can execute unintended commands on the server. This vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). No known exploits are reported in the wild. There is no explicit vendor advisory or patch information provided, so patch status is not confirmed.
CVE-2026-2514 is a high-severity cross-site scripting (XSS) vulnerability in Progress Software's Flowmon ADS versions prior to 12.5.5 and 13.0.3. An attacker with access to Flowmon monitoring ports can send malicious network data that, when processed and viewed by an authenticated user, executes unintended scripts in the user's browser. This vulnerability requires no authentication or privileges but does require user interaction to view the malicious data. Exploitation can lead to compromise of confidentiality, integrity, and availability of user sessions and data. No known exploits are currently reported in the wild. Organizations using affected versions should upgrade to the fixed releases to mitigate risk.
CVE-2026-2513 is a high-severity cross-site scripting (XSS) vulnerability in Progress Software Flowmon ADS versions prior to 12.5.5 and 13.0.3. It allows an attacker to craft a malicious link that, when clicked by an administrator, can trigger unintended actions within their authenticated web session. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). Exploitation requires user interaction (clicking the malicious link) but does not require prior authentication. The CVSS 4.0 score is 8.
In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption.
This issue affects Chef Inspec: through 5.23 and before 7.0.107
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.
A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.
A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session.
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via
improperly neutralized inputs used in an SQL command using a well-known token.
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
It was possible to perform Remote Command Execution (RCE) via Java
RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and
execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration
property with inadequate input validation leading to OS command injection.
Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access.
When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.
Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.
This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
