EUVD-2026-42381
GHSA-rwjf-g383-jc9c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable HTTPS module with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); spoofing yields integrity impact only (I:H, C:N/A:N), matching the 'limited' bypass description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
AnalysisAI
Authentication bypass by spoofing in Progress MOVEit Transfer's HTTPS module allows remote unauthenticated attackers to impersonate or partially bypass identity verification, compromising integrity (CVSS 7.5, I:H) without exposing or destroying data (C:N/A:N). The flaw affects MOVEit Transfer builds before 2025.0.7 and the 2025.1.x line before 2025.1.3; a vendor patch is available. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but MOVEit Transfer's history as a mass-exploitation target warrants prompt patching.
Technical ContextAI
MOVEit Transfer is a managed file transfer (MFT) server used by enterprises to move sensitive files over HTTPS, SFTP and FTPS with auditing and compliance controls. This issue lives in the HTTPS (web) module and maps to CWE-290 (Authentication Bypass by Spoofing), a class where the application accepts a forged or spoofed identity indicator instead of properly verifying the authenticating principal - for example trusting a client-supplied token, header, or session artifact that can be replayed or forged. The CPE data (cpe:2.3:a:progress:moveit_transfer) confirms the affected component is the Progress MOVEit Transfer application itself rather than the separate MOVEit Automation/Gateway products. The vendor labels the impact 'limited,' implying the spoof grants only partial identity assumption rather than full administrative takeover, consistent with the partial technical impact recorded in SSVC.
RemediationAI
Vendor-released patch: upgrade to MOVEit Transfer 2025.0.7 (for the pre-2025.1 line) or 2025.1.3 (for the 2025.1.x line), whichever matches your deployment, as documented in the Progress fixed-issues notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html. Because the flaw is in the HTTPS module and reachable by unauthenticated network clients, if immediate patching is not possible restrict exposure of the MOVEit web/HTTPS interface to trusted networks or a VPN and place it behind a WAF or reverse proxy that can inspect and reject spoofed authentication artifacts, accepting that this may block legitimate external partners who rely on direct HTTPS access. Increase monitoring of authentication and session logs for anomalous or replayed identity tokens, and confirm the fixed build is running after upgrade since there is no reliable compensating control that fully substitutes for the patch.
More in Moveit Transfer
View allIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.0.0 be
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.
Path-equivalence weakness in Progress MOVEit Transfer's File Upload modules lets remote attackers bypass path-normalizat
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote u
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.0.0 bef
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web appl
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in w
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today