Progress MOVEit Transfer CVE-2025-10932

Exploitation requires that the MOVEit Transfer AS2 module be enabled and network-reachable (typically an internet- or partner-facing AS2 endpoint used for business-to-business file exchange); the flaw is scoped specifically to that module, so instances without AS2 configured are not exposed. Per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed and complexity is low (AC:L), so once AS2 is exposed a remote unauthenticated attacker can trigger it against default-but-AS2-enabled configurations. The primary limiting factor is the non-default dependency on the AS2 module being active; impact is confined to availability/service degradation (A:H) with no confidentiality loss (C:N) and at most low integrity impact.

Multiple signals point to a moderate, availability-focused risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high availability impact (A:H) and only low integrity impact (C:N/I:L), consistent with the CWE-400 Uncontrolled Resource Consumption / Denial-of-Service classification and the 'Denial Of Service' tag. SSVC-style reasoning: technical impact is partial (service availability, not full system compromise), and while the flaw is network-automatable in principle, exploitation is gated on the AS2 module being enabled. The EPSS score is low (0.48%, 40th percentile), there is no CISA KEV listing, and no public exploit code was identified - so there is no evidence of active or imminent widespread exploitation. The I:L metric in the supplied vector is debatable for a pure resource-exhaustion bug (DoS typically maps to availability only); this is a minor inconsistency to verify with the vendor advisory. Net: a legitimately patch-worthy unauthenticated DoS in internet-facing file-transfer software, but current exploitation probability is low and it is not a drop-everything issue absent KEV/POC signals.

A remote, unauthenticated attacker reaches an internet-facing MOVEit Transfer instance with the AS2 module enabled and submits crafted AS2 traffic designed to consume excessive server resources. Sustained or repeated requests exhaust resources and degrade or deny service to legitimate file-transfer users. No public proof-of-concept exploit was identified at the time of analysis, and the low complexity (AC:L) means no special timing or race conditions are required once AS2 is exposed.