Progress MOVEit Transfer

• CVE-2026-89077 High 7.5 MOVEit Transfer Identity validation flaw in SFTP authentication 0.5%
• CVE-2026-89076 High 7.2 MOVEit Transfer SQL injection in custom reporting 0.5%
• CVE-2026-89075 High 7.3 MOVEit Transfer Local Disclosure of Session Information Vulnerability 0.2%
• CVE-2026-89074 High 7.5 MOVEit Transfer Email MFA Bypass 0.5%
• CVE-2026-89073 High 7.5 MOVEit Transfer Access restriction bypass in OAuth authentication 0.4%
• CVE-2026-89072 High 7.5 MOVEit Transfer Authorization Flaw in Certificate Management 0.2%
• CVE-2026-89071 High 7.5 MOVEit Transfer LDAP injection in certificate-based authentication 0.5%
• CVE-2026-89070 High 7.5 MOVEit Transfer OIDC Authentication Replay Vulnerability 0.4%
• CVE-2026-89069 High 8.0 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages 0.4%
• CVE-2026-89068 High 8.1 MOVEit Transfer Authentication bypass in LDAP sign-on 0.5%
• CVE-2026-89067 High 8.8 MOVEit Transfer Secure Messaging Authentication Bypass 0.5%
• CVE-2026-87093 High 8.8 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation 0.2%
• CVE-2026-15968 High 7.1 Stored XSS vulnerability in MOVEit Transfer 0.3%
• CVE-2026-15967 High 7.5 MOVEit Transfer refresh-token processing does not enforce updated account restrictions 0.4%
• CVE-2026-15966 High 7.5 Improper CORS handling in MOVEit Transfer 0.4%
• CVE-2026-10697 High 7.5 MFA Bypass in MOVEit Transfer 0.6%
• CVE-2026-8801 Low 3.5 File Extension Restriction Bypass in MOVEit Transfer 0.5%
• CVE-2026-8800 Low 2.7 Cross-Org External Token Metadata accessible to AuditUser role 0.4%
• CVE-2026-8651 Low 3.7 IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer 0.4%
• CVE-2026-8650 Medium 4.5 Authenticated Path Traversal allows MOVEit admins to view arbitrary system files 0.6%
• CVE-2026-8649 Medium 6.4 Institution scope bypass vulnerability in custom reports 0.5%
• CVE-2026-11903 High 8.0 Stored XSS in MOVEit Transfer Ad Hoc module 0.4%
• CVE-2026-10699 High 7.5 Memory leak in SFTP service can result in a denial of service in MOVEit Transfer 0.5%
• CVE-2026-10698 High 7.2 Table scope bypass vulnerability in custom reports 0.6%
• CVE-2025-11235 Low 3.7 MOVEit Transfer REST API does not require current password in order to initiate the password change process 0.2%
• CVE-2025-13147 Medium 5.3 External Service Interaction (DNS) 0.3%
• CVE-2025-10932 High 8.2 AS2 module allows uncontrolled file uploads 0.5%
• CVE-2025-2324 Medium 5.9 A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder 0.3%
• CVE-2024-6576 High 7.3 MOVEit Transfer Privilege Escalation Vulnerability 0.6%
• CVE-2024-5806 Critical 9.1 MOVEit Transfer Authentication Bypass Vulnerability 81.5%