Skip to content
OpenAdvisories

Product · Progress

MOVEit Transfer

30 known vulnerabilities.

MOVEit Transfer at a glance

Last 12 months
26
Critical · all time
1
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 12 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 12 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 2026120
Sep 202600
Aug 202600
Jul 2026120
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202510
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Latest advisories

  • High max 8.0
    NCSC-2026-0226 3 CVEs

    Kwetsbaarheden verholpen in Progress MOVEit Transfer

    Progress heeft kwetsbaarheden verholpen in MOVEit Transfer, specifiek in de Custom Reports modules en de Ad Hoc module.

    Progress
  • High max 5.3
    NCSC-2025-0375 1 CVE

    Kwetsbaarheid verholpen in Progress MOVEit Transfer

    Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies vóór 2024.1.8 en van 2025.0.0 tot vóór 2025.0.4).

    Progress
  • High max 8.2
    NCSC-2025-0346 1 CVE

    Kwetsbaarheid verholpen in Progress MOVEit Transfer

    Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies 2025.0.0 tot 2025.0.3, 2024.1.0 tot 2024.1.7, en 2023.1.0 tot 2023.1.16).

    Progress
  • High max 7.3
    NCSC-2024-0321 1 CVE

    Kwetsbaarheid verholpen in Progress MOVEit Transfer

    Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (SFTP)

    Progress
  • High max 9.1
    NCSC-2024-0267 2 CVEs rev. 2

    Kwetsbaarheden verholpen in Progress MOVEit

    Progress heeft kwetsbaarheden verholpen in MOVEit Transfer en MOVEit Gateway. Tijdens het onderzoek naar de kwetsbaarheden is ook een kwetsbaarheid ontdekt in een niet nader benoemde Third-Party component dat in gebruik is door MOVEit Transfer.

    Progress Ipswitch
All Critical High Medium Low Exploited only Public exploit

30 results · Feed

  • High 7.5
    CVE-2026-89077

    MOVEit Transfer Identity validation flaw in SFTP authentication

    Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.2
    CVE-2026-89076

    MOVEit Transfer SQL injection in custom reporting

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.3
    CVE-2026-89075

    MOVEit Transfer Local Disclosure of Session Information Vulnerability

    Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89074

    MOVEit Transfer Email MFA Bypass

    Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89073

    MOVEit Transfer Access restriction bypass in OAuth authentication

    Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89072

    MOVEit Transfer Authorization Flaw in Certificate Management

    Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89071

    MOVEit Transfer LDAP injection in certificate-based authentication

    Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-89070

    MOVEit Transfer OIDC Authentication Replay Vulnerability

    Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.0
    CVE-2026-89069

    MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.1
    CVE-2026-89068

    MOVEit Transfer Authentication bypass in LDAP sign-on

    Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.8
    CVE-2026-89067

    MOVEit Transfer Secure Messaging Authentication Bypass

    Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 8.8
    CVE-2026-87093

    MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

    Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    Progress MOVEit Transfer
  • High 7.1
    CVE-2026-15968

    Stored XSS vulnerability in MOVEit Transfer

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-15967

    MOVEit Transfer refresh-token processing does not enforce updated account restrictions

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-15966

    Improper CORS handling in MOVEit Transfer

    Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-10697

    MFA Bypass in MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress MOVEit Transfer
  • Low 3.5
    CVE-2026-8801

    File Extension Restriction Bypass in MOVEit Transfer

    Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

    Progress MOVEit Transfer
  • Low 2.7
    CVE-2026-8800

    Cross-Org External Token Metadata accessible to AuditUser role

    Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Low 3.7
    CVE-2026-8651

    IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

    Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Medium 4.5
    CVE-2026-8650

    Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

    Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • Medium 6.4
    CVE-2026-8649

    Institution scope bypass vulnerability in custom reports

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

    Progress MOVEit Transfer
  • High 8.0
    CVE-2026-11903

    Stored XSS in MOVEit Transfer Ad Hoc module

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 bef…

    Progress MOVEit Transfer
  • High 7.5
    CVE-2026-10699

    Memory leak in SFTP service can result in a denial of service in MOVEit Transfer

    Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

    Progress MOVEit Transfer
  • High 7.2
    CVE-2026-10698

    Table scope bypass vulnerability in custom reports

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

    Progress MOVEit Transfer
  • Low 3.7
    CVE-2025-11235

    MOVEit Transfer REST API does not require current password in order to initiate the password change process

    Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

    Progress MOVEit Transfer
  • Medium 5.3
    CVE-2025-13147

    External Service Interaction (DNS)

    Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

    Progress MOVEit Transfer
  • High 8.2
    CVE-2025-10932

    AS2 module allows uncontrolled file uploads

    Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

    Progress MOVEit Transfer
  • Medium 5.9
    CVE-2025-2324

    A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder

    Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2…

    Progress MOVEit Transfer
  • High 7.3
    CVE-2024-6576

    MOVEit Transfer Privilege Escalation Vulnerability

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.

    Progress MOVEit Transfer
  • Critical 9.1
    CVE-2024-5806 Public exploit EPSS 81%

    MOVEit Transfer Authentication Bypass Vulnerability

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

    Progress MOVEit Transfer