MOVEit Transfer vulnerabilities

36 known vulnerabilities in MOVEit Transfer from Progress Software. 36 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  MOVEit Transfer: Incorrect Implementation of Authentication Algorithm

  CVE-2026-89077Oct 14, 2026Progress Software

  Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-89076Oct 14, 2026Progress Software

  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 7.3 High severity

  MOVEit Transfer: Insecure Storage of Sensitive Information

  CVE-2026-89075Oct 14, 2026Progress Software

  Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Improper Handling of Unicode Encoding

  CVE-2026-89074Oct 14, 2026Progress Software

  Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 9.8 Critical severity

  Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.

  CVE-2026-89073Oct 14, 2026Progress Software

  Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Incorrect Authorization

  CVE-2026-89072Oct 14, 2026Progress Software

  Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Improper Neutralization of Special Elements used in an LDAP Query

  CVE-2026-89071Oct 14, 2026Progress Software

  Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 7.5 High severity

  MOVEit Transfer: Authentication Bypass by Capture-replay

  CVE-2026-89070Oct 14, 2026Progress Software

  Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 9.8 Critical severity

  MOVEit Transfer: Missing Critical Step in Authentication

  CVE-2026-89068Oct 14, 2026Progress Software

  Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-89067Oct 14, 2026Progress Software

  Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 8.8 High severity

  MOVEit Transfer: Incorrect Permission Assignment for Critical Resource

  CVE-2026-87093Oct 14, 2026Progress Software

  Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

• 9.8 Critical severity

  Insufficient session expiration vulnerability in Progress MOVEit Transfer.

  CVE-2026-15967Jul 23, 2026Progress Software

  Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

• 9.8 Critical severity

  MOVEit Transfer: Permissive Cross-domain Security Policy with Untrusted Domains

  CVE-2026-15966Jul 23, 2026Progress Software

  Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

• 9.8 Critical severity

  MOVEit Transfer: Improper Authentication

  CVE-2026-10697Jul 23, 2026Progress Software

  Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

• 9.8 Critical severity

  MOVEit Transfer: Path Equivalence: 'filename ' (Trailing Space)

  CVE-2026-8801Jul 8, 2026Progress Software

  Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

• 8.8 High severity

  MOVEit Transfer: Incorrect Authorization

  CVE-2026-8800Jul 8, 2026Progress Software

  Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

• 7.5 High severity

  MOVEit Transfer: Authentication Bypass by Spoofing

  CVE-2026-8651Jul 8, 2026Progress Software

  Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

• 7.5 High severity

  MOVEit Transfer: Relative Path Traversal

  CVE-2026-8650Jul 8, 2026Progress Software

  Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

• 9.8 Critical severity

  MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic

  CVE-2026-8649Jul 8, 2026Progress Software

  Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

• 7.5 High severity

  MOVEit Transfer: Missing Release of Memory after Effective Lifetime

  CVE-2026-10699Jul 8, 2026Progress Software

  Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

• 7.2 High severity

  MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic

  CVE-2026-10698Jul 8, 2026Progress Software

  Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

• 7.5 High severity

  MOVEit Transfer: Unverified Password Change

  CVE-2025-11235Jan 7, 2026Progress Software

  Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

• 8.2 High severity

  MOVEit Transfer: Uncontrolled Resource Consumption

  CVE-2025-10932Oct 29, 2025Progress Software

  Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

• 8.8 High severity

  MOVEit Transfer: Improper Privilege Management

  CVE-2025-2324Mar 19, 2025Progress Software

  Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 20

• 9.8 Critical severity

  MOVEit Transfer: Improper Authentication

  CVE-2024-6576Jul 29, 2024Progress Software

  Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.

• 9.8 Critical severity

  MOVEit Transfer: Improper Authentication

  CVE-2024-5806Jun 25, 2024Progress SoftwareEPSS 81.1%

  Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

• 7.1 High severity

  In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11)…

  CVE-2024-0396Jan 17, 2024Progress Software

  In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modifie

• 7.2 High severity

  MOVEit Transfer: Improper Privilege Management

  CVE-2023-6218Nov 29, 2023Progress Software

  In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group me

• 8.8 High severity

  MOVEit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-42660Sep 20, 2023Progress Software

  In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attack

• 7.2 High severity

  MOVEit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-40043Sep 20, 2023Progress Software

  In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrat

• 9.1 Critical severity

  Moveit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-36934Jul 5, 2023Progress SoftwareEPSS 95.2%

  In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow

• 7.5 High severity

  Moveit Transfer: Improper Handling of Exceptional Conditions

  CVE-2023-36933Jul 5, 2023Progress SoftwareEPSS 72.2%

  In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause t

• 8.1 High severity

  Moveit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-36932Jul 5, 2023Progress SoftwareEPSS 81.1%

  In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that c

• 9.8 Critical severity

  Moveit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-35708Jun 16, 2023Progress SoftwareEPSS 96.7%

  In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated a

• 9.1 Critical severity

  Moveit Transfer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-35036Jun 12, 2023Progress SoftwareEPSS 12.8%

  In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attac

• 9.8 Critical severity

  Progress MOVEit Transfer SQL Injection Exploited

  CVE-2023-34362Jun 2, 2023Progress SoftwareEPSS 99.9%

  In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attack