What is the CVSS score of CVE-2026-10697?

CVE-2026-10697 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MOVEit Transfer are affected by CVE-2026-10697?

Progress MOVEit Transfer versions prior to 2025.1.5 and 2026.0.0 through 2026.0.3 contain a critical authentication bypass allowing unauthenticated remote attackers to seize full control of the file…. A patch is available.

How to fix or mitigate CVE-2026-10697?

Within 24 hours, conduct a complete inventory of MOVEit Transfer deployments to identify instances running affected versions (pre-2025.1.5 or 2026.0.0 through 2026.0.3), and immediately apply network-level access restrictions to prevent external connections to vulnerable systems if immediate patching is not feasible. Within 7 days, apply vendor patches to all affected instances, upgrading to Progress MOVEit Transfer 2025.1.5 or later for the 2025.x branch or 2026.0.3 or later for the 2026.x branch, with priority given to internet-facing and externally accessible deployments. Within 30 days, review access logs for indicators of exploitation activity during the vulnerable window and conduct a validation audit to confirm all instances are running patched versions.

MOVEit Transfer CVE-2026-10697

EUVD-2026-48417 CRITICAL

Improper Authentication (CWE-287)

2026-07-23 ProgressSoftware

GHSA-55q6-5qrm-8ccf

Authentication Bypass Moveit Transfer Progress

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ProgressSoftware) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-facing MFT with an unauthenticated auth bypass (PR:N/UI:N/AC:L) yielding full application control, so C/I/A all High; no scope change beyond the application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 16:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Jul 30, 2026 - 15:52 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 20:53 vuln.today

CVE Published

Jul 23, 2026 - 19:54 cve.org

HIGH 7.5

DescriptionNVD

Improper Authentication vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

AnalysisAI

Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote unauthenticated attackers defeat identity verification and gain full control over the managed file transfer server. Because MOVEit is a high-value data-exchange gateway, a successful bypass exposes all hosted files and administrative functions. No public exploit identified at time of analysis, and EPSS probability is low (0.18%, 8th percentile) despite the 9.8 CVSS, reflecting no observed exploitation yet.

Technical ContextAI

MOVEit Transfer is Progress Software's enterprise managed file transfer (MFT) platform, exposing HTTPS/SFTP/FTPS interfaces for secure business-to-business file exchange and browser-based transfers. The root cause is CWE-287 (Improper Authentication), meaning the application fails to correctly verify a user's claimed identity - for example by mishandling session tokens, credentials, or authentication state - allowing an actor to be treated as a legitimate (potentially administrative) principal without valid credentials. The single affected component is confirmed by CPE cpe:2.3:a:progress:moveit_transfer, and the CWE class places this alongside the pattern of MFT gateways being targeted precisely because they authenticate external parties over the network.

RemediationAI

Apply the vendor-released patch: upgrade MOVEit Transfer to 2026.0.3 for the 2026 branch, or to 2025.1.5 (or later) for earlier deployments, as described in the Progress fixed-issues advisory (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html). Upgrading is the only complete fix for an authentication bypass and should be prioritized. Until patched, reduce exposure by restricting network reachability of the MOVEit web/transfer interfaces to known partner IP ranges via firewall or a reverse proxy allowlist (trade-off: may block legitimate external partners and require coordination), enforcing MFA on all accounts where supported, and closely monitoring authentication and administrative-action logs for anomalous logins or new admin accounts (trade-off: detective only, does not prevent the bypass). Do not rely on these controls as a substitute for the upgrade.