Progress
Progress Openedge: vulnerabilities and CVEs
Progress Openedge has 15 published vulnerabilities, 2 of them in the last 12 months. 5 are rated critical and 0 are listed by CISA as actively exploited.
CVEs15
Last 12 months2
Critical5
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-8095 | Critical (9.1) | 0.22% | — | Apr 14, 2026 | The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings… |
| CVE-2025-7389 | High (8.2) | 0.33% | — | Apr 14, 2026 | A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The… |
| CVE-2025-7388 | High (8.4) | 0.92% | — | Sep 4, 2025 | It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the… |
| CVE-2024-7654 | Medium (6.1) | 0.29% | — | Sep 3, 2024 | An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed… |
| CVE-2024-7346 | Medium (4.8) | 0.16% | — | Sep 3, 2024 | Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default… |
| CVE-2024-7345 | Critical (9.6) | 0.59% | — | Sep 3, 2024 | Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS… |
| CVE-2024-1403 | Critical (9.8) | 3.3% | — | Feb 27, 2024 | In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a… |
| CVE-2023-40052 | High (7.5) | 0.57% | — | Jan 18, 2024 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 . An attacker who can produce a malformed web request… |
| CVE-2023-40051 | Critical (9.9) | 0.56% | — | Jan 18, 2024 | This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB… |
| CVE-2023-34203 | High (8.8) | 1.1% | — | Jun 23, 2023 | In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g.,… |
| CVE-2022-29849 | High (7.8) | 0.28% | — | May 2, 2022 | In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges… |
| CVE-2015-9245 | Critical (9.8) | 1.9% | — | Oct 31, 2017 | Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931. |
| CVE-2014-8555 | Medium (5) | 7.5% | — | Nov 12, 2014 | Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the selection parameter. |
| CVE-2007-2417 | High (10) | 16% | — | Jul 15, 2007 | Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA Authentication Manager 6.0 and 6.1, SecurID Appliance 2.0, ACE/Server 5.2, and possibly other… |
| CVE-2007-3491 | High (7.5) | 2.5% | — | Jun 29, 2007 | Buffer overflow in _mprosrv in Progress Software OpenEdge before 9.1E0422, and 10.x before 10.1B01, allows remote attackers to have an unknown impact via a malformed TCP/IP message. |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.