Moveit Transfer (Progress) - vulnerabilities (CVEs)

49 CVEs, 12 in the last 30 days, 114 known versions, newest CVE from 2026-10-14. Vendor: Progress.

CVEs of Moveit Transfer

CVE-2026-89077 - CVSS 8.8 (high), 2026-10-14: Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before…
CVE-2026-89076 - CVSS 8.8 (high), 2026-10-14: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This…
CVE-2026-89075 - CVSS 7.3 (high), 2026-10-14: Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0…
CVE-2026-89074 - CVSS 8.8 (high), 2026-10-14: Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
CVE-2026-89073 - CVSS 9.8 (critical), 2026-10-14: Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
CVE-2026-89072 - CVSS 8.8 (high), 2026-10-14: Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
CVE-2026-89071 - CVSS 8.8 (high), 2026-10-14: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue…
CVE-2026-89070 - CVSS 7.5 (high), 2026-10-14: Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
CVE-2026-89069 - CVSS 8 (high), 2026-10-14: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue…
CVE-2026-89068 - CVSS 9.8 (critical), 2026-10-14: Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
CVE-2026-89067 - CVSS 8.8 (high), 2026-10-14: Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and…
CVE-2026-87093 - CVSS 8.8 (high), 2026-10-14: Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from…
CVE-2026-15968 - CVSS 7.1 (high), 2026-07-23: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit…
CVE-2026-15967 - CVSS 9.8 (critical), 2026-07-23: Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
CVE-2026-15966 - CVSS 9.8 (critical), 2026-07-23: Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,…
CVE-2026-10697 - CVSS 9.8 (critical), 2026-07-23: Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
CVE-2026-8801 - CVSS 9.8 (critical), 2026-07-08: Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before…
CVE-2026-8800 - CVSS 8.8 (high), 2026-07-08: Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0…
CVE-2026-8651 - CVSS 7.5 (high), 2026-07-08: Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from…
CVE-2026-8650 - CVSS 7.5 (high), 2026-07-08: Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0…
CVE-2026-8649 - CVSS 9.8 (critical), 2026-07-08: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit…
CVE-2026-11903 - CVSS 8 (high), 2026-07-08: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue…
CVE-2026-10699 - CVSS 7.5 (high), 2026-07-08: Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer:…
CVE-2026-10698 - CVSS 7.2 (high), 2026-07-08: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit…
CVE-2025-11235 - CVSS 7.5 (high), 2026-01-07: Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before…
CVE-2025-13147 - CVSS 5.3 (medium), 2025-11-19: Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.
CVE-2025-10932 - CVSS 8.2 (high), 2025-10-29: Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3,…
CVE-2025-2324 - CVSS 8.8 (high), 2025-03-19: Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This…
CVE-2024-6576 - CVSS 9.8 (critical), 2024-07-29: Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from…
CVE-2024-5806 - CVSS 9.8 (critical), 2024-06-25: Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from…
CVE-2024-2291 - CVSS 4.3 (medium), 2024-03-20: In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass…
CVE-2024-0396 - CVSS 7.1 (high), 2024-01-17: In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue…
CVE-2023-6217 - CVSS 7.1 (high), 2023-11-29: In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS)…
CVE-2023-6218 - CVSS 7.2 (high), 2023-11-29: In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with…
CVE-2023-40043 - CVSS 7.2 (high), 2023-09-20: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability…
CVE-2023-42660 - CVSS 8.8 (high), 2023-09-20: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability…
CVE-2023-42656 - CVSS 6.1 (medium), 2023-09-20: In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site…
CVE-2023-36932 - CVSS 8.1 (high), 2023-07-05: In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4),…
CVE-2023-36934 - CVSS 9.1 (critical), 2023-07-05: In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a…
CVE-2023-36933 - CVSS 7.5 (high), 2023-07-05: In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an…
CVE-2023-35708 - CVSS 9.8 (critical), 2023-06-16: In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection…
CVE-2023-35036 - CVSS 9.1 (critical), 2023-06-12: In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection…
CVE-2023-34362 - CVSS 9.8 (critical), 2023-06-02: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection…
CVE-2021-38159 - CVSS 9.8 (critical), 2021-08-07: In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated…
CVE-2021-37614 - CVSS 8.8 (high), 2021-08-05: In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated…
CVE-2021-33894 - CVSS 8.8 (high), 2021-06-09: In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5),…
CVE-2021-31827 - CVSS 8.8 (high), 2021-05-18: In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an…
CVE-2020-28647 - CVSS 5.4 (medium), 2020-11-17: In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer…
CVE-2020-8612 - CVSS 9 (critical), 2020-02-14: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could…
CVE-2020-8611 - CVSS 8.8 (high), 2020-02-14: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that…