What’s Vulnerable › Products

Progress MOVEit Transfer vulnerabilities

50 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 28 published in the last 12 months.

Check whether your Progress MOVEit Transfer version is affected

Exploited Progress MOVEit Transfer vulnerabilities

• CVE-2023-34362 — Progress MOVEit Transfer SQL Injection Vulnerability

Latest Progress MOVEit Transfer vulnerabilities

• CVE-2026-89077 — MOVEit Transfer Identity validation flaw in SFTP authentication (CVSS 8.8)
• CVE-2026-89076 — MOVEit Transfer SQL injection in custom reporting (CVSS 8.8)
• CVE-2026-89075 — MOVEit Transfer Local Disclosure of Session Information Vulnerability (CVSS 7.3)
• CVE-2026-89074 — MOVEit Transfer Email MFA Bypass (CVSS 8.8)
• CVE-2026-89073 — MOVEit Transfer Access restriction bypass in OAuth authentication (CVSS 9.8)
• CVE-2026-89072 — MOVEit Transfer Authorization Flaw in Certificate Management (CVSS 8.8)
• CVE-2026-89071 — MOVEit Transfer LDAP injection in certificate-based authentication (CVSS 8.8)
• CVE-2026-89070 — MOVEit Transfer OIDC Authentication Replay Vulnerability (CVSS 7.5)
• CVE-2026-89069 — MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages (CVSS 5.4)
• CVE-2026-89068 — MOVEit Transfer Authentication bypass in LDAP sign-on (CVSS 9.8)
• CVE-2026-89067 — MOVEit Transfer Secure Messaging Authentication Bypass (CVSS 8.8)
• CVE-2026-87093 — MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation (CVSS 8.8)
• CVE-2026-15968 — Stored XSS vulnerability in MOVEit Transfer (CVSS 5.4)
• CVE-2026-15967 — MOVEit Transfer refresh-token processing does not enforce updated account restrictions (CVSS 9.8)
• CVE-2026-15966 — Improper CORS handling in MOVEit Transfer (CVSS 9.8)
• CVE-2026-10697 — MFA Bypass in MOVEit Transfer (CVSS 9.8)
• CVE-2026-8801 — File Extension Restriction Bypass in MOVEit Transfer (CVSS 9.8)
• CVE-2026-8800 — Cross-Org External Token Metadata accessible to AuditUser role (CVSS 8.8)
• CVE-2026-8651 — IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer (CVSS 7.5)
• CVE-2026-8650 — Authenticated Path Traversal allows MOVEit admins to view arbitrary system files (CVSS 7.5)
• CVE-2026-8649 — Institution scope bypass vulnerability in custom reports (CVSS 9.8)
• CVE-2026-11903 — Stored XSS in MOVEit Transfer Ad Hoc module (CVSS 5.4)
• CVE-2026-10699 — Memory leak in SFTP service can result in a denial of service in MOVEit Transfer (CVSS 7.5)
• CVE-2026-10698 — Table scope bypass vulnerability in custom reports (CVSS 7.2)
• CVE-2025-11235 — MOVEit Transfer REST API does not require current password in order to initiate the password change process (CVSS 7.5)