EUVD-2026-42384
GHSA-4844-25m4-j7hc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web module exploitable by an already-authenticated low-privilege user (PR:L), no user interaction, yielding admin-level access across confidentiality, integrity, and availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
AnalysisAI
Privilege/authorization bypass in Progress MOVEit Transfer's Audit User module lets an authenticated low-privileged user perform actions beyond their intended permissions, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). Affected builds are all releases before 2025.0.7 and the 2025.1.x line before 2025.1.3. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) with CISA SSVC marking exploitation as 'none' indicates no observed exploitation despite MOVEit's history as a ransomware target.
Technical ContextAI
MOVEit Transfer is a widely deployed managed file transfer (MFT) server used by enterprises to move sensitive data over HTTPS/SFTP/FTPS with auditing and compliance controls. The flaw is classed as CWE-863 (Incorrect Authorization), meaning the application performs an authorization check but implements it incorrectly - here within the 'Audit User' module, a role intended for read-only review of audit/activity logs. Incorrect Authorization differs from missing authentication: the user is logged in and holds some role, but the access-control logic fails to correctly constrain what that role can do, allowing operations reserved for higher-privilege accounts. The two CPE entries both reference cpe:2.3:a:progress:moveit_transfer with wildcard versions, so the version boundaries come from the advisory rather than distinct CPE ranges.
RemediationAI
Vendor-released patch: upgrade to MOVEit Transfer 2025.0.7 or later on the 2025.0.x branch, or to 2025.1.3 or later on the 2025.1.x branch; both fixed builds close the Audit User authorization gap. Consult the Progress fixed-issues release notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html for the exact build and upgrade procedure. Until patching completes, reduce exposure by tightly reviewing and minimizing accounts assigned the Audit User role and any other low-privileged roles, since exploitation requires valid authenticated credentials; restrict the MOVEit web interface to trusted networks or place it behind a VPN to limit which authenticated sessions can reach the vulnerable module, accepting that this may impede legitimate remote users; and increase monitoring of audit-log access and privileged-action events to detect anomalous activity by low-privilege accounts. These controls limit blast radius but do not remove the flaw - patching is the only complete fix.
More in Moveit Transfer
View allIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.0.0 be
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.
Path-equivalence weakness in Progress MOVEit Transfer's File Upload modules lets remote attackers bypass path-normalizat
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Authentication bypass in Progress MOVEit Transfer (versions before 2025.1.5, and 2026.0.0 before 2026.0.3) lets remote u
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.0.0 bef
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web appl
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in w
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today