Product by Progress

    Progress MOVEit Transfer

    50 known vulnerabilities in Progress MOVEit Transfer (Progress), 1 of them actively exploited (CISA KEV).

    Key figures

    50

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    15

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Progress MOVEit Transfer (Progress)
    CriticalCVE-2023-34362

    Progress MOVEit Transfer SQL Injection Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2023-35708

    Progress MOVEit Transfer: SQL Injection

    		9.8
    CriticalCVE-2024-5806

    MOVEit Transfer Authentication Bypass Vulnerability

    		9.1
    CriticalCVE-2023-36934

    Progress MOVEit Transfer: SQL Injection

    		9.1
    HighCVE-2023-36932

    Progress MOVEit Transfer: SQL Injection

    		8.1
    CriticalCVE-2023-35036

    Progress MOVEit Transfer: SQL Injection

    		9.1
    HighCVE-2023-36933

    Progress MOVEit Transfer: security vulnerability

    		7.5
    CriticalCVE-2021-38159

    Progress MOVEit Transfer: SQL Injection

    		9.8
    CriticalCVE-2020-8612

    Progess Moveit Transfer: Cross-Site Scripting (XSS)

    		9.0
    HighCVE-2026-89067

    MOVEit Transfer Secure Messaging Authentication Bypass

    also in 1 other product

    		8.8
    CriticalCVE-2026-10697

    MFA Bypass in MOVEit Transfer

    also in 1 other product

    		9.8
    HighCVE-2021-37614

    Progress MOVEit Transfer: SQL Injection

    		8.8
    CriticalCVE-2026-89068

    MOVEit Transfer Authentication bypass in LDAP sign-on

    also in 1 other product

    		8.1
    HighCVE-2026-89071

    MOVEit Transfer LDAP injection in certificate-based authentication

    also in 1 other product

    		7.5
    HighCVE-2020-8611

    Progess Moveit Transfer: SQL Injection

    		8.8
    CriticalCVE-2026-8649

    Institution scope bypass vulnerability in custom reports

    		9.8
    HighCVE-2026-89076

    MOVEit Transfer SQL injection in custom reporting

    also in 1 other product

    		7.2
    HighCVE-2026-89069

    MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

    also in 1 other product

    		8.0
    HighCVE-2021-31827

    Progress MOVEit Transfer: SQL Injection

    		8.8
    HighCVE-2026-89074

    MOVEit Transfer Email MFA Bypass

    also in 1 other product

    		7.5
    HighCVE-2026-89077

    MOVEit Transfer Identity validation flaw in SFTP authentication

    also in 1 other product

    		7.5
    HighCVE-2026-89070

    MOVEit Transfer OIDC Authentication Replay Vulnerability

    also in 1 other product

    		7.5
    HighCVE-2021-33894

    Progress MOVEit Transfer: SQL Injection

    		8.8
    CriticalCVE-2026-15966

    Improper CORS handling in MOVEit Transfer

    also in 1 other product

    		9.8
    CriticalCVE-2026-15967

    MOVEit Transfer refresh-token processing does not enforce updated account restrictions

    also in 1 other product

    		9.8

    All vulnerabilities in search

    All products by Progress