MOVEit Transfer vulnerabilities | LiveThreat CVE Feed

File Transfer

MOVEit Transfer

by Progress · last CVE Oct 14, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities50 In the news0 Timeline

Severity mix

Critical 15High 27Medium 8Low 0

Severity

All severities50 Critical15 High27 Medium8 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add MOVEit Transfer to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-6217	6.1	1%	Nov 29	In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been… Affected: through 2021.1.0; 2022.0.0 before 2022.0.9; 2022.1.0 before 2022.1.10; 2023.0.0 before 2023.0.7; 2023.1.0 before 2023.1.2
CVE-2023-42656	6.1	1%	Sep 20	In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS)… Affected: before 2021.1.8; 2022.0.0 before 2022.0.8; 2022.1.0 before 2022.1.9; 2023.0.0 before 2023.0.6
CVE-2026-89069	5.4	0%	Oct 14	MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages Affected: before 2025.1.6; 2026.0.0 before 2026.0.4
CVE-2026-15968	5.4	0%	Jul 23	Stored XSS vulnerability in MOVEit Transfer Affected: before 2025.1.5; 2026.0.0 before 2026.0.3
CVE-2026-11903	5.4	0%	Jul 8	Stored XSS in MOVEit Transfer Ad Hoc module Affected: 2026.0.0 before 2026.0.1; 2025.1.0 before 2025.1.4; 2025.0.0 before 2025.0.8
CVE-2020-28647	5.4	1%	Nov 17	In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application Affected: before 2020.1
CVE-2025-13147	5.3	0%	Nov 19	External Service Interaction (DNS) Affected: before 2024.1.8; 2025.0.0 before 2025.0.4
CVE-2024-2291	4.3	0%	Mar 20	In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been… Affected: before 2022.0.11; 2022.1.0 before 2022.1.12; 2023.0.0 before 2023.0.9; 2023.1.0 before 2023.1.4