EUVD-2026-42370
GHSA-jh92-gc65-pg86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing MOVEit web interface
-
DeliverySend crafted input to Custom Reports endpoint
-
ExploitBreak out of backend data query logic
-
ExecutionExecute injected query
-
ImpactExfiltrate or alter transferred file data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation targets the Custom Reports modules of MOVEit Transfer; the attacker must be able to reach a report-query endpoint that processes untrusted input, which for internet-facing MOVEit deployments is the default web interface. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are required and complexity is low, so the primary limiting factor is network reachability of the Custom Reports feature - deployments that place the MOVEit interface behind a VPN/IP allowlist or that restrict report access substantially reduce exposure. Affected only on versions below 2025.0.7, 2025.1.3, and 2026.0.0. |
| Impact | Signals conflict and must be weighed carefully. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), indicating trivially reachable, unauthenticated network exploitation with total impact - the theoretical worst case. However EPSS is only 0.22% (13th percentile) and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no,' while confirming Technical Impact as 'total.' This combination points to a serious but not-yet-exploited flaw that is not trivially wormable or mass-automatable, rather than an actively abused mass-exploit. Given MOVEit's track record as a Cl0p ransomware target in 2023, the low EPSS should be read as 'no observed exploitation yet,' not 'safe to defer.' No POC and no KEV listing exist at time of analysis, so this is a patch-now item driven by asset criticality and CVSS, not by confirmed in-the-wild activity. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends crafted input to a MOVEit Transfer Custom Reports endpoint, injecting special elements that alter the backend data query. The manipulated query returns unauthorized data or modifies/deletes records, exposing transferred files and metadata. No public POC has been identified at time of analysis, but the low attack complexity and lack of authentication make weaponization feasible if a technique is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 10, 2026
SQL/NoSQL query injection in Progress MOVEit Transfer (Custom Reports modules) lets remote unauthenticated attackers manipulate backend data-query logic to read, alter, or destroy managed-file-transfer data across versions before 2025.0.7, 2025.1.3, and 2026.0.0. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, though real-world exploitation is currently rated low (EPSS 0.22%, CISA SSVC exploitation 'none') and no public exploit has been identified at time of analysis. MOVEit's history as a mass-exploitation target (Cl0p, 2023) makes this a high-priority patch despite the currently quiet threat signal.
Earlier versions of this analysis (2)
Data query injection (CWE-943) in Progress MOVEit Transfer's Custom Reports module allows remote attackers to manipulate backend query logic and extract or alter data, with no public exploit identified at time of analysis. The flaw carries a 9.8 critical CVSS rating and affects MOVEit Transfer releases before 2025.0.7, before 2025.1.3, and before 2026.0.0. Given MOVEit Transfer's history as a repeated mass-exploitation target (e.g. the 2023 CL0P campaign), this managed-file-transfer product warrants urgent patching despite a currently low EPSS score of 0.22%.
NoSQL injection in Progress MOVEit Transfer's Custom Reports module allows authenticated high-privilege users to manipulate data query logic through improperly neutralized special elements. Affected versions span all MOVEit Transfer releases prior to 2026.0.0, 2025.1.3, and 2025.0.7. Successful exploitation - which requires both high-privilege authentication and user interaction - can result in full confidentiality, integrity, and availability compromise of the underlying data store, though the PR:H/UI:R prerequisites substantially reduce real-world attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor patch by upgrading to a fixed build: MOVEit Transfer 2025.0.7 for the 2025.0.x branch, 2025.1.3 for the 2025.1.x branch, or 2026.0.0, per Progress's Fixed Issues release notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html. Patch status: patch available per vendor advisory. If immediate patching is not possible, reduce exposure by restricting or disabling access to the Custom Reports functionality for untrusted users, placing the MOVEit web interface behind a VPN or IP allowlist to remove unauthenticated internet reachability, and enabling WAF rules to filter query-injection patterns against report endpoints - noting these controls may disrupt legitimate reporting workflows and remote partner access and are stopgaps only. Given MOVEit's history, also monitor logs for anomalous report queries and review data-access audit trails.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOVEit Transfer is a widely deployed enterprise managed file transfer (MFT) platform used to exchange sensitive files between organizations, frequently internet-facing. The flaw resides in the Custom Reports modules and is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), the parent class covering both SQL and NoSQL injection; vendor tags specifically cite 'Nosql Injection' and 'Information Disclosure.' Because report-generation logic constructs data queries from attacker-influenced input without proper neutralization, crafted input can break out of the intended query structure and change its meaning. The single CPE cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* confirms the affected product is the MOVEit Transfer application across all sub-versions below the fixed builds.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Custom Reports endpoint is reachable without authentication or user interaction and query injection yields total data confidentiality, integrity, and availability impact, so PR:N/UI:N/AC:L and C/I/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: before 2026.0.0, before 2025.1.3, before 2025.0.7.
Executive ViewAI
Progress MOVEit Transfer installations are vulnerable to unauthenticated SQL/NoSQL injection in Custom Reports modules, allowing attackers to read, modify, or destroy all managed file-transfer data without authentication. Organizations using affected versions face potential compromise of their entire file transfer infrastructure. Immediate patching is critical given MOVEit's history as a mass-exploitation target and the full confidentiality, integrity, and availability impact.
Apply vendor patch. If immediate patching is delayed: restrict MOVEit access to specific IP ranges and authenticated users only; disable Custom Reports modules until patched; conduct forensic audit of file-transfer activity logs for unauthorized access or data modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB