EUVD-2026-42381
GHSA-rwjf-g383-jc9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MOVEit HTTPS endpoint over network
-
DeliveryCraft request with spoofed identity token
-
ExploitBypass authentication check (CWE-290)
-
ExecutionAssume trusted identity (limited)
-
ImpactTamper with data or actions (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the MOVEit Transfer HTTPS (web) module, which is the exact affected component named in the CVE; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration is documented, so a standard internet- or intranet-exposed MOVEit Transfer HTTPS listener on an unpatched version (before 2025.0.7, or 2025.1.0-2025.1.2) is sufficient. Limiting factors: the vendor characterizes it as a 'limited' bypass with partial technical impact (SSVC) and integrity-only effect (C:N/A:N), so an attacker gains constrained identity assumption rather than full account takeover or data exfiltration; SSVC also rates it Automatable: no, indicating exploitation is not trivially scalable across targets. |
| Impact | Signals are mixed and lean toward moderate, patch-soon rather than emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a low-complexity, network-reachable, unauthenticated attack - attractive on paper - but impact is constrained to integrity (I:H) with no confidentiality or availability effect, and the vendor scopes it as a 'limited' bypass. EPSS is low at 0.22% (12th percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, and it is not on the KEV list - no public exploit identified at time of analysis. These corroborate a real but not-yet-weaponized risk. The tension to flag: MOVEit Transfer is a repeated mass-exploitation target (historically), so a low EPSS today can understate future risk if exploit code emerges; the 'no public exploit' and low EPSS reflect current state, not an upper bound. Treat as high priority for MFT operators despite modest scoring signals. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends crafted HTTPS requests to an internet-exposed MOVEit Transfer web endpoint, presenting a forged or spoofed authentication indicator that the server trusts, thereby assuming another identity to a limited degree and tampering with data or actions permitted to that identity. No user interaction or prior authentication is required (PR:N/UI:N), and attack complexity is low; however, no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 09, 2026
Authentication bypass by spoofing in Progress MOVEit Transfer's HTTPS module allows remote unauthenticated attackers to impersonate or partially bypass identity verification, compromising integrity (CVSS 7.5, I:H) without exposing or destroying data (C:N/A:N). The flaw affects MOVEit Transfer builds before 2025.0.7 and the 2025.1.x line before 2025.1.3; a vendor patch is available. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but MOVEit Transfer's history as a mass-exploitation target warrants prompt patching.
Earlier versions of this analysis (2)
Authentication bypass by spoofing in the HTTPS module of Progress MOVEit Transfer allows a remote, unauthenticated attacker to partially circumvent identity verification and tamper with data integrity. The flaw affects MOVEit Transfer versions before 2025.0.7 and the 2025.1.x branch before 2025.1.3, is network-reachable with low attack complexity, and carries a CVSS 7.5 rating driven purely by a high integrity impact. It is not in CISA KEV and has no public exploit identified at time of analysis, with a low EPSS score (0.22%, 12th percentile) and CISA SSVC marking exploitation as 'none'.
Authentication bypass via spoofing in Progress MOVEit Transfer's HTTPS module allows unauthenticated remote attackers to partially circumvent access controls, resulting in limited unauthorized integrity modifications. Affected versions span the 2025.0.x branch (before 2025.0.7) and the 2025.1.x branch (before 2025.1.3). No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, MOVEit Transfer's historical profile as a high-value target warrants prompt patching despite the low CVSS score.
RemediationAI
Vendor-released patch: upgrade to MOVEit Transfer 2025.0.7 (for the pre-2025.1 line) or 2025.1.3 (for the 2025.1.x line), whichever matches your deployment, as documented in the Progress fixed-issues notes at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html. Because the flaw is in the HTTPS module and reachable by unauthenticated network clients, if immediate patching is not possible restrict exposure of the MOVEit web/HTTPS interface to trusted networks or a VPN and place it behind a WAF or reverse proxy that can inspect and reject spoofed authentication artifacts, accepting that this may block legitimate external partners who rely on direct HTTPS access. Increase monitoring of authentication and session logs for anomalous or replayed identity tokens, and confirm the fixed build is running after upgrade since there is no reliable compensating control that fully substitutes for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOVEit Transfer is a managed file transfer (MFT) server used by enterprises to move sensitive files over HTTPS, SFTP and FTPS with auditing and compliance controls. This issue lives in the HTTPS (web) module and maps to CWE-290 (Authentication Bypass by Spoofing), a class where the application accepts a forged or spoofed identity indicator instead of properly verifying the authenticating principal - for example trusting a client-supplied token, header, or session artifact that can be replayed or forged. The CPE data (cpe:2.3:a:progress:moveit_transfer) confirms the affected component is the Progress MOVEit Transfer application itself rather than the separate MOVEit Automation/Gateway products. The vendor labels the impact 'limited,' implying the spoof grants only partial identity assumption rather than full administrative takeover, consistent with the partial technical impact recorded in SSVC.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable HTTPS module with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); spoofing yields integrity impact only (I:H, C:N/A:N), matching the 'limited' bypass description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Executive ViewAI
Progress MOVEit Transfer contains an authentication bypass vulnerability (CVE-2026-8651) allowing remote attackers to impersonate users and gain unauthorized access to file transfer operations without valid credentials. Organizations rely on MOVEit Transfer to securely exchange sensitive files with internal and external partners; this vulnerability directly undermines that control, with heightened concern given the product's documented history as a frequent exploitation target.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB