Vulnerabilities

TI-2026-74048 CVE-2026-89077 · GHSA-9f7h-q8p6-83jv

Incorrect authentication algorithm in Progress MOVEit Transfer SFTP module

MEDIUM 40

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00463 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-303

TI-2026-74047 CVE-2026-89076 · GHSA-xcw4-ch93-wcpr

SQL injection in MOVEit Transfer custom reporting

MEDIUM 41

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00519 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-89

TI-2026-74046 CVE-2026-89075 · GHSA-58x2-jh6g-gpg3

Insecure storage of session information in Progress MOVEit Transfer

LOW 33

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.0018 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-922

TI-2026-74045 CVE-2026-89074 · GHSA-vhqc-26qr-xc8f

Improper Unicode handling in MOVEit Transfer bypasses email MFA

MEDIUM 41

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00482 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-176

TI-2026-74044 CVE-2026-89073 · GHSA-vwr9-5p5q-ghvv

Access restriction bypass in Progress MOVEit Transfer OAuth authentication

MEDIUM 43

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.004 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-613

TI-2026-74043 CVE-2026-89072 · GHSA-8x86-c3g4-f798

Incorrect authorization in Progress MOVEit Transfer certificate management

MEDIUM 40

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-863

TI-2026-74042 CVE-2026-89071 · GHSA-f2xf-w3f6-6rc6

LDAP injection in Progress MOVEit Transfer certificate authentication

MEDIUM 41

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00521 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-90

TI-2026-74041 CVE-2026-89070 · GHSA-6rcx-229v-9xmv

Authentication bypass in Progress MOVEit Transfer OIDC module

LOW 35

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.0044 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-294

TI-2026-74040 CVE-2026-89069 · GHSA-gwhj-7mgx-69jf

Stored cross-site scripting in MOVEit Transfer Ad Hoc packages

LOW 37

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00438 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-79

TI-2026-74039 CVE-2026-89068 · GHSA-5c4v-2gqh-mh8p

Authentication bypass in Progress MOVEit Transfer LDAP sign-on

MEDIUM 44

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00536 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-304

TI-2026-74038 CVE-2026-89067 · GHSA-68gr-2c6m-jxp6

Authentication bypass in Progress MOVEit Transfer secure messaging

MEDIUM 41

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00529 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-288

TI-2026-74037 CVE-2026-87093 · GHSA-98jf-248c-5xqj

Writable service directory in MOVEit Transfer enables privilege escalation

LOW 39

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00158 Published 2026-10-14 Fixed in 2025.1.6, 2026.0.4 CWE-732

TI-2026-13370 CVE-2026-15968 · GHSA-hq56-w6jm-c6vp

Stored XSS vulnerability in MOVEit Transfer

LOW 33

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00332 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-79

TI-2026-13369 CVE-2026-15967 · GHSA-qpgc-j6gh-m63q

MOVEit Transfer refresh-token processing does not enforce updated account restrictions

MEDIUM 43

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00373 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-613

TI-2026-13368 CVE-2026-15966 · GHSA-9rcg-65vx-h53x

Improper CORS handling in MOVEit Transfer

MEDIUM 43

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00373 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-942

TI-2026-09196 CVE-2026-10697 · GHSA-55q6-5qrm-8ccf

MFA Bypass in MOVEit Transfer

MEDIUM 44

Improper Authentication vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00596 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-287

TI-2026-07737 CVE-2026-8801 · GHSA-g7h5-mc2v-rvpm

File Extension Restriction Bypass in MOVEit Transfer

MEDIUM 43

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00546 Published 2026-07-08 Fixed in 2025.1.4, 2025.0.8 CWE-46

TI-2026-07736 CVE-2026-8800 · GHSA-4844-25m4-j7hc

Cross-Org External Token Metadata accessible to AuditUser role

LOW 38

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0037 Published 2026-07-08 Fixed in 2025.1.3, 2025.0.7 CWE-863

TI-2026-07600 CVE-2026-8651 · GHSA-rwjf-g383-jc9c

IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

LOW 33

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00366 Published 2026-07-08 Fixed in 2025.1.3, 2025.0.7 CWE-290

TI-2026-07599 CVE-2026-8650 · GHSA-qp89-5wp8-rj83

Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

LOW 34

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00601 Published 2026-07-08 Fixed in 2025.1.3, 2025.0.7 CWE-23

TI-2026-07598 CVE-2026-8649 · GHSA-jh92-gc65-pg86

Institution scope bypass vulnerability in custom reports

MEDIUM 43

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00463 Published 2026-07-08 Fixed in 2025.1.3, 2025.0.7 CWE-943

TI-2026-10270 CVE-2026-11903 · GHSA-j526-4hhw-j4mr

Stored XSS in MOVEit Transfer Ad Hoc module

LOW 37

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00408 Published 2026-07-08 Fixed in 2026.0.1, 2025.1.4 +1 CWE-79

TI-2026-09198 CVE-2026-10699 · GHSA-r246-g2w6-6gr3

Memory leak in SFTP service can result in a denial of service in MOVEit Transfer

LOW 39

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00494 Published 2026-07-08 Fixed in 2025.0.8, 2025.1.4 +1 CWE-401

TI-2026-09197 CVE-2026-10698 · GHSA-8rpj-q4gm-gm6v

Table scope bypass vulnerability in custom reports

LOW 35

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00644 Published 2026-07-08 Fixed in 2025.0.8, 2025.1.4 +1 CWE-943

TI-2025-10289 CVE-2025-11235 · GHSA-738g-29rj-2mjw

MOVEit Transfer REST API does not require current password in order to initiate the password change process

LOW 32

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 20…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00213 Published 2026-01-06 Fixed in 2023.1.3, 2023.0.8 +2 CWE-620

Vulnerabilities

Filters