[progress]

September 8, 2026

• TantoSec published a working exploit chain turning an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated RCE — but only against applications in a specific non-default configuration. Progress patched the chain in July and there are no confirmed reports of in-the-wild exploitation (The Hacker News). · New Tools & Releases

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

August 9, 2026

• Progress Kemp LoadMaster RCE (CVE-2026-8037) was added to CISA KEV after 792 reported exploit attempts; watchTowr says it flagged customer exposure 39 days ahead of the KEV listing (The Hacker News). · Vulnerabilities & Exploits

in AI Agents' Black Hat Reckoning Goes Public

July 15, 2026

• Progress confirmed the ShareFile Storage Zone Controller shutdown was driven by an actively exploited high-severity zero-day and has now shipped patches — closing out the emergency takedown reported last week (earlier coverage). BleepingComputer · Vulnerabilities & Exploits

in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days