MOVEit Transfer EUVD-2026-101150

Exploitation requires the MOVEit Transfer OIDC authentication module (OpenID Connect SSO) to be configured and in use - instances using other authentication methods are not exposed to this specific flaw. The attacker must be positioned to capture a legitimate OIDC authentication message/token (CVSS AC:H) and must rely on a real user performing the authentication (CVSS UI:R), then replay the captured material before it expires or is invalidated. Limiting factors: OIDC is a non-universal configuration choice, the need to intercept a valid live exchange raises the bar beyond unauthenticated blind access, and user interaction is required; affected only on versions before 2025.1.6 and 2026.0.0-2026.0.3.

This is a vendor-reported (Progress) authentication bypass via capture-replay (CWE-294) in the MOVEit Transfer OIDC module. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.2-7.5 High) signals network reach and no required attacker privileges, but materially tempers real-world risk through two factors: AC:H (the attacker must capture a valid OIDC authentication exchange and successfully replay it, implying timing/positioning constraints) and UI:R (a legitimate user must perform an authentication action the attacker can intercept). No EPSS score, CISA KEV listing, or POC data was supplied, so exploitation probability cannot be quantified from the input - but the absence of these signals is NOT evidence of safety given MOVEit Transfer's documented history as a high-value ransomware/data-extortion target (e.g., the 2023 Cl0p campaign). There is a notable discrepancy: the sole reference is titled a 'Critical Security Bulletin' while the assigned CVSS is 7.5 (High) - verify severity framing with Progress. No SSVC decision data was provided. Net: treat as a genuine priority for any environment running MOVEit Transfer with OIDC/SSO enabled, but recognize that exploitation is conditioned on OIDC configuration, user interaction, and capture positioning rather than being trivially mass-exploitable.

An attacker positioned to observe or intercept a victim's OIDC single sign-on authentication exchange with a MOVEit Transfer instance captures the authentication message/token and replays it to the server to establish an authenticated session as that user, bypassing authentication. Because scope is unchanged and impact is full CIA, the attacker then gains the victim's access to transferred files. No public exploit code was identified in the provided data, and success depends on capturing a valid exchange (AC:H) and the victim actually authenticating (UI:R).