Where
-Infinity
0

Trending

Last week
Last month
Last year

Progress MOVEit TransferMFA Bypass in MOVEit Transfer

Risk 86
Severity
9.8
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

First published (updated )
CVE-2026-10697

Progress MOVEit TransferImproper CORS handling in MOVEit Transfer

Risk 86
Severity
9.8
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

First published (updated )
CVE-2026-15966

Progress MOVEit TransferMOVEit Transfer refresh-token processing does not enforce updated account restrictions

Risk 86
Severity
9.8
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

First published (updated )
CVE-2026-15967

Progress MOVEit TransferStored XSS vulnerability in MOVEit Transfer

Risk 65
Severity
7.1
XSS
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

First published (updated )
CVE-2026-15968

Progress MOVEit TransferMOVEit Transfer Secure Messaging Authentication Bypass

Risk 79
Severity
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89067

Progress MOVEit TransferMOVEit Transfer Authentication bypass in LDAP sign-on

Risk 86
Severity
9.8
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89068

Progress MOVEit TransferMOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Risk 71
Severity
8
XSS
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89069

Progress MOVEit TransferMOVEit Transfer OIDC Authentication Replay Vulnerability

Risk 69
Severity
7.5
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89070

Progress MOVEit TransferMOVEit Transfer LDAP injection in certificate-based authentication

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89071

Progress MOVEit TransferMOVEit Transfer Authorization Flaw in Certificate Management

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89072

Progress MOVEit TransferMOVEit Transfer Access restriction bypass in OAuth authentication

Risk 86
Severity
9.8
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89073

Progress MOVEit TransferMOVEit Transfer Email MFA Bypass

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89074

Progress MOVEit TransferMOVEit Transfer Local Disclosure of Session Information Vulnerability

Risk 64
Severity
7.3
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89075

Progress MOVEit TransferMOVEit Transfer SQL injection in custom reporting

Risk 79
Severity
8.8
SQL Injection
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89076

Progress MOVEit TransferMOVEit Transfer Identity validation flaw in SFTP authentication

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-89077

Progress MOVEit TransferMOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Risk 72
Severity
8.8
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

First published (updated )
CVE-2026-87093

Progress MOVEit TransferAS2 module allows uncontrolled file uploads

Risk 54
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

First published (updated )
CVE-2025-10932

Progress MOVEit TransferInstitution scope bypass vulnerability in custom reports

Risk 61
Severity
9.8
EPSS
0.23%
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

First published (updated )
CVE-2026-8649

Progress MOVEit TransferTable scope bypass vulnerability in custom reports

Risk 66
Severity
7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

First published (updated )
CVE-2026-10698

Progress MOVEit TransferMemory leak in SFTP service can result in a denial of service in MOVEit Transfer

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

First published (updated )
CVE-2026-10699

Progress MOVEit TransferStored XSS in MOVEit Transfer Ad Hoc module

Risk 71
Severity
8
XSS
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

First published (updated )
CVE-2026-11903

Progress MOVEit TransferAuthenticated Path Traversal allows MOVEit admins to view arbitrary system files

Risk 31
Severity
7.5
EPSS
0.36%
Path Traversal
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

First published (updated )
CVE-2026-8650

Progress MOVEit TransferIPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

Risk 31
Severity
7.5
EPSS
0.21%
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

First published (updated )
CVE-2026-8651

Progress MOVEit TransferCross-Org External Token Metadata accessible to AuditUser role

Risk 56
Severity
8.8
EPSS
0.21%
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

First published (updated )
CVE-2026-8800

Progress MOVEit TransferFile Extension Restriction Bypass in MOVEit Transfer

Risk 61
Severity
9.8
EPSS
0.34%
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).

This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

First published (updated )
CVE-2026-8801

Progress MOVEit TransferA MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder

Risk 79
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2.

First published (updated )
CVE-2025-2324

Progress MOVEit TransferMOVEit Transfer Authentication Bypass Vulnerability

Risk 67
Severity
9.8
EPSS
0.50%
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

First published (updated )
CVE-2024-5806

Progress MOVEit TransferSQL Injection

Risk 69
Severity
9.1
SQL Injection
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

First published (updated )
CVE-2023-36934

Progress MOVEit TransferIn Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8…

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.

First published (updated )
CVE-2023-36933

Progress MOVEit TransferSQL Injection

Risk 60
Severity
8.1
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

First published (updated )
CVE-2023-36932

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203