# Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others CVE record · `CVE-2025-10702` - **Identifiers:** `CVE-2025-10702` - **State:** Confirmed - **Severity:** CVSS 8.6 High - **Critical:** No - **CNA:** ProgressSoftware - **Weakness (CWE):** [CWE-94](https://cwe.mitre.org/data/definitions/94.html) - **Tags:** [Code injection](https://agentprime.io/advisories/tag/code-injection.md) - **Technologies:** [Progress DataDirect Connect for JDBC for Amazon Redshift](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-amazon-redshift.md) · [Progress DataDirect Connect for JDBC for Apache Cassandra](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-apache-cassandra.md) · [Progress DataDirect Connect for JDBC for Hive](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-hive.md) · [Progress DataDirect Connect for JDBC for Apache Impala](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-apache-impala.md) · [Progress DataDirect Connect for JDBC for Apache SparkSQL](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-apache-sparksql.md) · [Progress DataDirect Connect for JDBC Autonomous REST Connector](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-autonomous-rest-connector.md) · [Progress DataDirect Connect for JDBC for DB2](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-db2.md) · [Progress DataDirect Connect for JDBC for Google Analytics 4](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-google-analytics-4.md) · [Progress DataDirect Connect for JDBC for Google BigQuery](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-google-bigquery.md) · [Progress DataDirect Connect for JDBC for Greenplum](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-greenplum.md) · [Progress DataDirect Connect for JDBC for Informix](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-informix.md) · [Progress DataDirect Connect for JDBC for Microsoft Dynamics 365](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-microsoft-dynamics-365.md) · [Progress DataDirect Connect for JDBC for Microsoft SQLServer](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-microsoft-sqlserver.md) · [Progress DataDirect Connect for JDBC for Microsoft Sharepoint](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-microsoft-sharepoint.md) · [Progress DataDirect Connect for JDBC for MongoDB](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-mongodb.md) · [Progress DataDirect Connect for JDBC for MySQL](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-mysql.md) · [Progress DataDirect Connect for JDBC for Oracle Database](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-oracle-database.md) · [Progress DataDirect Connect for JDBC for Oracle Eloqua](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-oracle-eloqua.md) · [Progress DataDirect Connect for JDBC for Oracle Sales Cloud](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-oracle-sales-cloud.md) · [Progress DataDirect Connect for JDBC for Oracle Service Cloud](https://agentprime.io/advisories/technology/progress-datadirect-connect-for-jdbc-for-oracle-service-cloud.md) - **Published:** 19 Nov 2025 - **Updated:** 4 Nov 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: ProgressSoftware) at 19 Nov 2025, 15:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Progress. Product: DataDirect Connect for JDBC for Amazon Redshift. - affected: `6.0.0.001392 and earlier` (custom) - unaffected: `6.0.0.001541` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Apache Cassandra. - affected: `6.0.0.000805 and earlier` (custom) - unaffected: `6.0.0.000833` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Hive. - affected: `6.0.1.001499 and earlier` (custom) - unaffected: `6.0.1.001628` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Apache Impala. - affected: `6.0.0.001155 and earlier` (custom) - unaffected: `6.0.0.1279` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Apache SparkSQL. - affected: `6.0.1.001222 and earlier` (custom) - unaffected: `6.0.1.001344` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC Autonomous REST Connector. - affected: `6.0.1.006961 and earlier` (custom) - unaffected: `6.0.1.007063` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for DB2. - affected: `6.0.0.000717 and earlier` (custom) - unaffected: `6.0.0.000964` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Google Analytics 4. - affected: `6.0.0.000454 and earlier` (custom) - unaffected: `6.0.0.000525` - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Google BigQuery. - affected: `6.0.0.002279 and earlier` (custom) - unaffected: `6.0.0.002410` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Greenplum. - affected: `6.0.0.001712 and earlier` (custom) - unaffected: `6.0.0.001727` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Informix. - affected: `6.0.0.000690 and earlier` (custom) - unaffected: `6.0.0.000851` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Microsoft Dynamics 365. - affected: `6.0.0.003161 and earlier` (custom) - unaffected: `6.0.0.003198` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Microsoft SQLServer. - affected: `6.0.0.001936 and earlier` (custom) - unaffected: `6.0.0.001957` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Microsoft Sharepoint. - affected: `6.0.0.001559 and earlier` (custom) - unaffected: `6.0.0.001587` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for MongoDB. - affected: `6.1.0.001654 and earlier` (custom) - unaffected: `6.1.0.001669` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for MySQL. - affected: `5.1.4.000330 and earlier` (custom) - unaffected: `5.1.4.000364` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Oracle Database. - affected: `6.0.0.001747 and earlier` (custom) - unaffected: `6.0.0.001776` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Oracle Eloqua. - affected: `6.0.0.001438 and earlier` (custom) - unaffected: `6.0.0.001458` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Oracle Sales Cloud. - affected: `6.0.0.001225 and earlier` (custom) - unaffected: `6.0.0.001316` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Oracle Service Cloud. - affected: `5.1.4.000298 and earlier` (custom) - unaffected: `5.1.4.000309` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for PostgreSQL. - affected: `6.0.0.001843 and earlier` (custom) - unaffected: `6.0.0.001856` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Progress OpenEdge. - affected: `5.1.4.000187 and earlier` (custom) - unaffected: `5.1.4.000189` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Salesforce. - affected: `6.0.0.003020 and earlier` (custom) - unaffected: `6.0.0.003125` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for SAP HANA. - affected: `6.0.0.000879 and earlier` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for SAP S/4 HANA. - affected: `6.0.1.001818 and earlier` (custom) - unaffected: `6.0.1.001858` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Sybase ASE. - affected: `5.1.4.000161 and earlier` (custom) - unaffected: `5.1.4.000162` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Connect for JDBC for Snowflake. - affected: `6.0.1.001821 and earlier` (custom) - unaffected: `6.0.1.001856` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Hybrid Data Pipeline Server. - affected: `4.6.2.3309 and earlier` (custom) - unaffected: `4.6.2.3430` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Hybrid Data Pipeline JDBC Driver. - affected: `4.6.2.0607 and earlier` (custom) - unaffected: `4.6.2.1023` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Hybrid Data Pipeline On Premises Connector. - affected: `4.6.2.1223 and earlier` (custom) - unaffected: `4.6.2.1339` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect Hybrid Data Pipeline Docker. - affected: `4.6.2.3316 and earlier` (custom) - unaffected: `4.6.2.3430` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect OpenAccess JDBC Driver. - affected: `8.1.0.0177 and earlier` (custom) - unaffected: `8.1.0.0183` (custom) - Other versions: unaffected - Vendor: Progress. Product: DataDirect OpenAccess JDBC Driver. - affected: `9.0.0.0019 and earlier` (custom) - unaffected: `9.0.0.0022` (custom) - Other versions: unaffected ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 8.6 High, CVSS 4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H`, from CNA (ProgressSoftware) - **CISA KEV:** Not listed. - **EPSS:** 0.0032, the 25th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline - 19 Nov 2025, 15:46 UTC: [Confirmed by the CVE List](https://www.cve.org/CVERecord?id=CVE-2025-10702) ## Sources - [CVE List: CVE-2025-10702](https://www.cve.org/CVERecord?id=CVE-2025-10702) - [NVD: CVE-2025-10702](https://nvd.nist.gov/vuln/detail/CVE-2025-10702) ### References from the CNA - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .