EUVD-2026-42384
GHSA-4844-25m4-j7hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege MOVEit account
-
DeliveryReach Audit User module over network
-
ExploitSend request exploiting incorrect authorization check
-
ExecutionPerform admin-level actions or access restricted data
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with valid MOVEit Transfer credentials (CVSS PR:L) - specifically interaction with the Audit User module, the role/feature named in the advisory - reachable over the network (AV:N) with low complexity and no user interaction. Limiting factors: the attacker must already possess a low-privileged account, so this is not pre-authentication despite the 'Authentication Bypass' tag; only instances running versions before 2025.0.7 or 2025.1.0-2025.1.2 are affected, and the Audit User (or comparable low-privilege) role must exist and be reachable. Organizations that do not provision low-privilege/audit accounts, or that restrict the web UI to trusted networks, materially reduce exposure. |
| Impact | Signals are mostly aligned toward moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) yields 8.8 High: network-reachable, low complexity, no user interaction, but crucially PR:L - an attacker must already hold a valid low-privileged MOVEit account. That authentication requirement, combined with EPSS 0.18% (8th percentile) and CISA SSVC of Exploitation:none / Automatable:no / Technical Impact:partial, points to real-but-not-widespread risk. Note the tension between the raw signals: the vendor tag labels this 'Authentication Bypass,' yet the CVSS PR:L and CWE-863 (Incorrect Authorization) describe privilege escalation by an already-authenticated user, not a pre-auth bypass - this discrepancy should be verified against the Progress advisory. Given MOVEit's status as a repeat mass-exploitation target (the 2023 Cl0p campaign), defenders should patch promptly even though current telemetry shows no exploitation. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privileged MOVEit Transfer account (for example an Audit User meant only to read logs) sends crafted authenticated requests to the Audit User module and, because the authorization check is enforced incorrectly, performs actions or accesses data reserved for administrators. Given AV:N/AC:L, this requires only network access to the web interface and valid credentials, with no user interaction. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Privilege/authorization bypass in Progress MOVEit Transfer's Audit User module lets an authenticated low-privileged user perform actions beyond their intended permissions, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). Affected builds are all releases before 2025.0.7 and the 2025.1.x line before 2025.1.3. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) with CISA SSVC marking exploitation as 'none' indicates no observed exploitation despite MOVEit's history as a ransomware target.
Earlier versions of this analysis (2)
Privilege escalation and data compromise in Progress MOVEit Transfer stems from an incorrect authorization flaw in the Audit User module, letting an authenticated low-privilege user access or modify resources beyond their intended scope with high confidentiality, integrity, and availability impact. It affects MOVEit Transfer versions before 2025.0.7 and the 2025.1.x branch before 2025.1.3, and a vendor patch is available. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) plus a CISA SSVC exploitation status of 'none' indicate no observed exploitation yet.
Incorrect Authorization in Progress MOVEit Transfer's Audit User module allows an authenticated high-privilege network attacker to access audit data beyond their intended authorization scope, resulting in limited confidentiality exposure. Affected versions include all releases before 2025.0.7 and the 2025.1.0 line before 2025.1.3. No public exploit code exists and this vulnerability is not listed in CISA KEV; the low CVSS score of 2.7 reflects the high authentication barrier and constrained impact, making this a lower operational priority despite MOVEit Transfer's historically high-profile exploit surface.
RemediationAI
Vendor-released patch: upgrade to MOVEit Transfer 2025.0.7 or later on the 2025.0.x branch, or to 2025.1.3 or later on the 2025.1.x branch; both fixed builds close the Audit User authorization gap. Consult the Progress fixed-issues release notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html for the exact build and upgrade procedure. Until patching completes, reduce exposure by tightly reviewing and minimizing accounts assigned the Audit User role and any other low-privileged roles, since exploitation requires valid authenticated credentials; restrict the MOVEit web interface to trusted networks or place it behind a VPN to limit which authenticated sessions can reach the vulnerable module, accepting that this may impede legitimate remote users; and increase monitoring of audit-log access and privileged-action events to detect anomalous activity by low-privilege accounts. These controls limit blast radius but do not remove the flaw - patching is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOVEit Transfer is a widely deployed managed file transfer (MFT) server used by enterprises to move sensitive data over HTTPS/SFTP/FTPS with auditing and compliance controls. The flaw is classed as CWE-863 (Incorrect Authorization), meaning the application performs an authorization check but implements it incorrectly - here within the 'Audit User' module, a role intended for read-only review of audit/activity logs. Incorrect Authorization differs from missing authentication: the user is logged in and holds some role, but the access-control logic fails to correctly constrain what that role can do, allowing operations reserved for higher-privilege accounts. The two CPE entries both reference cpe:2.3:a:progress:moveit_transfer with wildcard versions, so the version boundaries come from the advisory rather than distinct CPE ranges.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web module exploitable by an already-authenticated low-privilege user (PR:L), no user interaction, yielding admin-level access across confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Executive ViewAI
A privilege-escalation vulnerability in Progress MOVEit Transfer's Audit User module allows authenticated low-privileged users to perform unauthorized administrative actions within the file-transfer system, threatening data confidentiality and system integrity. While patch availability and minimal observed exploitation risk (0.2% EPSS) reduce immediate urgency, organizations must update before attackers develop reliable exploits against a historically ransomware-targeted platform.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB