MT
File Transfer
MOVEit Transfer
On CISA KEVExploited in the wildRansomware-linked
49
CVEs
1
On KEV
9.8
Max CVSS
12
New 30D
Severity mix
Critical 15High 26Medium 8Low 0
Watch
Add MOVEit Transfer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34362 RansomwareIn wildKEV | 9.8 | Jun 2 | Progress MOVEit Transfer SQL Injection Vulnerability Affected: before 2021.0.7; 2021.1.0 before 2021.1.5; 2022.0.0 before 2022.0.5; 2022.1.0 before 2022.1.6; 2023.0.0 before 2023.0.2 |
| CVE-2026-89073 | 9.8 | Oct 14 | MOVEit Transfer Access restriction bypass in OAuth authentication Affected: before 2025.1.6; 2026.0.0 before 2026.0.4 |
| CVE-2026-89068 | 9.8 | Oct 14 | MOVEit Transfer Authentication bypass in LDAP sign-on Affected: before 2025.1.6; 2026.0.0 before 2026.0.4 |
| CVE-2026-15967 | 9.8 | Jul 23 | MOVEit Transfer refresh-token processing does not enforce updated account restrictions Affected: before 2025.1.5; 2026.0.0 before 2026.0.3 |
| CVE-2026-15966 | 9.8 | Jul 23 | Improper CORS handling in MOVEit Transfer Affected: before 2025.1.5; 2026.0.0 before 2026.0.3 |
| CVE-2026-10697 | 9.8 | Jul 23 | MFA Bypass in MOVEit Transfer Affected: before 2025.1.5; 2026.0.0 before 2026.0.3 |
| CVE-2026-8801 | 9.8 | Jul 8 | File Extension Restriction Bypass in MOVEit Transfer Affected: 2025.1.0 before 2025.1.4; before 2025.0.8 |
| CVE-2026-8649 | 9.8 | Jul 8 | Institution scope bypass vulnerability in custom reports Affected: 2025.1.0 before 2025.1.3; before 2025.0.7 |
| CVE-2024-6576 | 9.8 | Jul 29 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before… Affected: 2023.0.0 before 2023.0.12; 2023.1.0 before 2023.1.7; 2024.0.0 before 2024.0.3 |
| CVE-2024-5806 | 9.8 | Jun 25 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before… Affected: 2023.0.0 before 2023.0.11; 2023.1.0 before 2023.1.6; 2024.0.0 |
| CVE-2023-35708 | 9.8 | Jun 16 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been… Affected: before 2020.1.10; 2021.0.6 before 2021.0.8; 2021.1.4 before 2021.1.6; 2022.0.4 before 2022.0.6; 2022.1.5 before 2022.1.7; 2023.0.1 before 2023.0.3 |
| CVE-2021-38159 | 9.8 | Aug 7 | In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to… Affected: before 2019.0.8; 2019.1 before 2019.1.7; 2019.2 before 2019.2.4; 2020.0 before 2020.0.7; 2020.1 before 2020.1.6; 2021.0 before 2021.0.4 |
| CVE-2023-36934 | 9.1 | Jul 5 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection… Affected: before 12.1.11; 13.0.0 before 13.0.9; 13.1.0 before 13.1.7; 14.0.0 before 14.0.7; 14.1.0 before 14.1.8; 15.0.0 before 15.0.4 |
| CVE-2023-35036 | 9.1 | Jun 12 | In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found… Affected: before 2021.0.7; 2021.1.0 before 2021.1.5; 2022.0.0 before 2022.0.5; 2022.1.0 before 2022.1.6; 2023.0.0 before 2023.0.2 |
| CVE-2020-8612 | 9.0 | Feb 14 | In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an… Affected: 2019.2 before 2019.2.1 |
Showing 15