Progress Moveit Transfer vulnerabilities

CVE-2026-89077 High · 7.5 CWE-303 Oct 14, 2026

MOVEit Transfer Identity validation flaw in SFTP authentication

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89076 High · 7.2 CWE-89 Oct 14, 2026

MOVEit Transfer SQL injection in custom reporting

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89075 High · 7.3 CWE-922 Oct 14, 2026

MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89074 High · 7.5 CWE-176 Oct 14, 2026

MOVEit Transfer Email MFA Bypass

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89073 High · 7.5 CWE-613 Oct 14, 2026

MOVEit Transfer Access restriction bypass in OAuth authentication

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89072 High · 7.5 CWE-863 Oct 14, 2026

MOVEit Transfer Authorization Flaw in Certificate Management

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89071 High · 7.5 CWE-90 Oct 14, 2026

MOVEit Transfer LDAP injection in certificate-based authentication

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89070 High · 7.5 CWE-294 Oct 14, 2026

MOVEit Transfer OIDC Authentication Replay Vulnerability

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89069 High · 8.0 CWE-79 Oct 14, 2026

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89068 High · 8.1 CWE-304 Oct 14, 2026

MOVEit Transfer Authentication bypass in LDAP sign-on

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-87093 High · 8.8 CWE-732 Oct 14, 2026

MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89067 High · 8.8 CWE-288 Oct 14, 2026

MOVEit Transfer Secure Messaging Authentication Bypass

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2025-11235 High · 7.5 CWE-620 Jan 7, 2026

MOVEit Transfer REST API does not require current password in order to initiate the password change process

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

CVE-2025-13147 Medium · 5.3 CWE-918 Nov 19, 2025

External Service Interaction (DNS)

Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

CVE-2025-10932 High · 8.2 CWE-400 Oct 29, 2025

AS2 module allows uncontrolled file uploads

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

CVE-2023-34362 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-89 Jun 2, 2023

Progress MOVEit Transfer SQL Injection Vulnerability

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.