Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2025-10702

Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others

CVSS 8.6 HighEPSS 0.0032 · 25th percentile

Published by the CVE Program (CNA: ProgressSoftware) at 19 Nov 2025, 15:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Progress DataDirect Connect for JDBC for Amazon Redshift
  • affected 6.0.0.001392 and earlier custom
  • unaffected 6.0.0.001541 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Apache Cassandra
  • affected 6.0.0.000805 and earlier custom
  • unaffected 6.0.0.000833 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Hive
  • affected 6.0.1.001499 and earlier custom
  • unaffected 6.0.1.001628 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Apache Impala
  • affected 6.0.0.001155 and earlier custom
  • unaffected 6.0.0.1279 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Apache SparkSQL
  • affected 6.0.1.001222 and earlier custom
  • unaffected 6.0.1.001344 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC Autonomous REST Connector
  • affected 6.0.1.006961 and earlier custom
  • unaffected 6.0.1.007063 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for DB2
  • affected 6.0.0.000717 and earlier custom
  • unaffected 6.0.0.000964 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Google Analytics 4
  • affected 6.0.0.000454 and earlier custom
  • unaffected 6.0.0.000525
Other versions: unaffected
Progress DataDirect Connect for JDBC for Google BigQuery
  • affected 6.0.0.002279 and earlier custom
  • unaffected 6.0.0.002410 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Greenplum
  • affected 6.0.0.001712 and earlier custom
  • unaffected 6.0.0.001727 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Informix
  • affected 6.0.0.000690 and earlier custom
  • unaffected 6.0.0.000851 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Microsoft Dynamics 365
  • affected 6.0.0.003161 and earlier custom
  • unaffected 6.0.0.003198 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Microsoft SQLServer
  • affected 6.0.0.001936 and earlier custom
  • unaffected 6.0.0.001957 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Microsoft Sharepoint
  • affected 6.0.0.001559 and earlier custom
  • unaffected 6.0.0.001587 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for MongoDB
  • affected 6.1.0.001654 and earlier custom
  • unaffected 6.1.0.001669 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for MySQL
  • affected 5.1.4.000330 and earlier custom
  • unaffected 5.1.4.000364 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Oracle Database
  • affected 6.0.0.001747 and earlier custom
  • unaffected 6.0.0.001776 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Oracle Eloqua
  • affected 6.0.0.001438 and earlier custom
  • unaffected 6.0.0.001458 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Oracle Sales Cloud
  • affected 6.0.0.001225 and earlier custom
  • unaffected 6.0.0.001316 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Oracle Service Cloud
  • affected 5.1.4.000298 and earlier custom
  • unaffected 5.1.4.000309 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for PostgreSQL
  • affected 6.0.0.001843 and earlier custom
  • unaffected 6.0.0.001856 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Progress OpenEdge
  • affected 5.1.4.000187 and earlier custom
  • unaffected 5.1.4.000189 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Salesforce
  • affected 6.0.0.003020 and earlier custom
  • unaffected 6.0.0.003125 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for SAP HANA
  • affected 6.0.0.000879 and earlier custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for SAP S/4 HANA
  • affected 6.0.1.001818 and earlier custom
  • unaffected 6.0.1.001858 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Sybase ASE
  • affected 5.1.4.000161 and earlier custom
  • unaffected 5.1.4.000162 custom
Other versions: unaffected
Progress DataDirect Connect for JDBC for Snowflake
  • affected 6.0.1.001821 and earlier custom
  • unaffected 6.0.1.001856 custom
Other versions: unaffected
Progress DataDirect Hybrid Data Pipeline Server
  • affected 4.6.2.3309 and earlier custom
  • unaffected 4.6.2.3430 custom
Other versions: unaffected
Progress DataDirect Hybrid Data Pipeline JDBC Driver
  • affected 4.6.2.0607 and earlier custom
  • unaffected 4.6.2.1023 custom
Other versions: unaffected
Progress DataDirect Hybrid Data Pipeline On Premises Connector
  • affected 4.6.2.1223 and earlier custom
  • unaffected 4.6.2.1339 custom
Other versions: unaffected
Progress DataDirect Hybrid Data Pipeline Docker
  • affected 4.6.2.3316 and earlier custom
  • unaffected 4.6.2.3430 custom
Other versions: unaffected
Progress DataDirect OpenAccess JDBC Driver
  • affected 8.1.0.0177 and earlier custom
  • unaffected 8.1.0.0183 custom
Other versions: unaffected
Progress DataDirect OpenAccess JDBC Driver
  • affected 9.0.0.0019 and earlier custom
  • unaffected 9.0.0.0022 custom
Other versions: unaffected
Identifiers
CVE-2025-10702
CNA
ProgressSoftware
Weakness (CWE)
CWE-94
Tags
Published
19 Nov 2025
Updated
4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.6 High 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H CNA (ProgressSoftware)
  • CISA KEV Not listed.
  • EPSS 0.0032, the 25th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 19 Nov 2025, 15:46 UTC Confirmed by the CVE List

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.