EUVD-2026-101146
GHSA-68gr-2c6m-jxp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MOVEit Transfer over network
-
DeliveryAuthenticate as low-privilege user
-
ExploitAbuse alternate path/channel to bypass authz
-
ExecutionAccess or modify protected file-transfer data
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation targets the authentication/authorization logic of MOVEit Transfer via an alternate path or channel (CWE-288), reachable over the network. Per the CVSS vector (PR:L), the attacker needs at least a low-privilege authenticated foothold or access to an authenticated channel rather than being fully pre-auth; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: only MOVEit Transfer versions before 2025.1.6 and 2026.0.0 through before 2026.0.4 are affected, so patched or newer builds are not exploitable; the requirement for some level of credentialed access (PR:L) narrows the attacker population versus a purely anonymous bypass. The exact feature/endpoint constituting the 'alternate channel' is not detailed in the available description and should be confirmed from the Progress bulletin. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper cut. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity authentication bypass (CWE-288, alternate path or channel) requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H, score 8.8). The affected product, Progress MOVEit Transfer, is a managed file-transfer appliance that has a documented history of mass exploitation (notably the 2023 Cl0p campaigns), which materially raises the real-world threat relative to the raw score. However, several key signals are MISSING and must not be presented as present: there is no EPSS score, no CISA KEV listing, and no public POC referenced in the input - so at time of analysis there is no confirmed active exploitation. Note a mild tension worth verifying: the title says 'authentication bypass' yet the CVSS carries PR:L (requiring some authenticated privilege) rather than PR:N; this suggests the bypass escalates or crosses a trust boundary from an already-authenticated (possibly low-privilege) context rather than being a fully pre-auth bypass - confirm the exact pre-conditions with the Progress advisory. Given the product's attractiveness to ransomware/extortion actors, defenders should treat this as high priority and patch promptly despite the absence of KEV/EPSS data. |
| Exploit ScenarioDerived | A remote attacker with a low-privilege MOVEit Transfer account (or who can reach an authenticated channel) sends requests through an alternate path that the authentication logic fails to validate, bypassing intended access controls to read, modify, or exfiltrate transferred files and data. No user interaction is required and attack complexity is low. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.
RemediationAI
Upgrade MOVEit Transfer to the first fixed build in the applicable release line: 2025.1.6 or later for the 2025.1.x branch, and 2026.0.4 or later for the 2026.0.x branch, as directed by the Progress advisory at https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026. Until the upgrade is complete, apply targeted compensating controls rather than generic hardening: since exploitation requires a low-privilege authenticated position (PR:L), immediately disable or rotate credentials for stale, shared, and service accounts and remove unused low-privilege roles. Where the transfer workflow permits, restrict access to the MOVEit web interface to known partner and corporate IP ranges or place it behind a WAF/reverse proxy with strict path normalization, accepting that such filtering commonly breaks legitimate partner drop-offs and automated transfers if allowlists are too narrow. If the affected patch note identifies a specific alternate channel or legacy endpoint, disable that interface or plugin entirely and monitor its access logs; the trade-off is loss of that integration until the upgrade lands. Because the vulnerable interface selects among multiple request paths, ensure reverse proxies do not normalize or rewrite URL paths in ways that reintroduce an alternate route, and enable and centrally ship MOVEit audit and authentication logs so attempted bypasses can be correlated. No vendor-released patch alternative or date-specific workaround beyond upgrading was provided in the available data, and no public exploit code was identified at time of analysis, so the residual risk is primarily from unpatched, internet-exposed instances rather than from active attacks observed so far.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-288, Authentication Bypass Using an Alternate Path or Channel, a child of the broader Improper Authentication class (CWE-287): the application enforces authentication or authorization on one expected route, method, or interface, but a functionally equivalent alternate route reaches the same protected resource without those checks. Progress MOVEit Transfer is an enterprise managed file transfer (MFT) platform typically exposed to partners and internet users through a web application alongside secondary access interfaces (transfer endpoints, administrative console, automation and API surfaces), and that multiplicity of routes is exactly the condition in which CWE-288 defects arise. The CPE supplied is the version-agnostic cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*, so it does not by itself distinguish vulnerable builds, but the vendor advisory scopes the defect concretely to MOVEit Transfer before 2025.1.6 and to 2026.0.0 through versions before 2026.0.4. The vulnerability is network reachable with low attack complexity and no user interaction (AV:N/AC:L/UI:N), needs a low-privileged authenticated position (PR:L), and stays within a single security authority (S:U) while producing high confidentiality and integrity loss. The specific endpoint or channel constituting the "alternate path" is not detailed in the available description and should be confirmed from the Progress bulletin before attempting any targeted detection. Given that MOVEit Transfer has been a high-profile mass-exploitation target in past campaigns, defenders should treat this authentication-bypass class as strategically significant even without current exploitation evidence.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity authn/authz bypass needing a low-privilege foothold (PR:L), no user interaction, with high confidentiality, integrity, and availability impact on the file-transfer system.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Executive ViewAI
Progress MOVEit Transfer, the managed file transfer platform widely used to exchange sensitive data with partners and customers, contains an authentication bypass that lets an attacker who already holds a low-privilege account reach functionality normally reserved for privileged users. Because that escalation path grants access to files and records the platform is trusted to protect, any organization running an affected release faces potential exposure of regulated or confidential data and unauthorized modification of transfer integrity. Leadership should care because the flaw has no vendor patch yet and the vendor has issued a Critical Security Bulletin, meaning affected instances remain exposed until remediation or compensating controls are in place.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to MOVEit Transfer administrative and management interfaces to trusted IP ranges; disable or tightly scope unused and low-privilege accounts, since exploitation requires an existing authenticated foothold; enforce least privilege and multifactor authentication on all MOVEit accounts; monitor and alert on anomalous authentication and privileged file-transfer activity; and engage Progress support for vendor-provided mitigation guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB