MOVEit Transfer EUVD-2026-48417

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation over the network against MOVEit Transfer's exposed transfer/web interface, with no user interaction and low complexity. The primary limiting factors are: the target must be running an affected version (any release before 2025.1.5, or 2026.0.0-2026.0.2), and the MOVEit interface must be network-reachable by the attacker - internet-exposed instances are at greatest risk, while instances restricted to private networks or partner allowlists are substantially harder to reach. No specific non-default feature toggle is named in the available description.

The signals are partly conflicting and should be read together rather than in isolation. CVSS 3.1 rates this 9.8 Critical with AV:N/AC:L/PR:N/UI:N and total C/I/A impact, indicating trivially reachable, unauthenticated, high-impact compromise - consistent with SSVC's Technical Impact of 'total'. However, SSVC records Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.18% (8th percentile), so there is no evidence of active or automated exploitation at this time. This is not a KEV-listed threat and no POC is referenced, so the near-term real-world risk is lower than the raw 9.8 suggests - but MOVEit's history as a mass-exploitation target (prior campaigns) means this should be treated as a high-priority patch regardless, because the pre-conditions for widespread abuse (network-facing, no auth, full impact) are all present and only exploit availability is currently missing.

An attacker who can reach the MOVEit Transfer HTTPS interface over the internet sends crafted requests that abuse the improper authentication logic to be recognized as a valid or administrative user without supplying legitimate credentials. From that authenticated context they browse, download, or tamper with all hosted files and can pivot to administrative functions. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of required interaction make weaponization straightforward if internals become known.