Known vulnerabilities in MOVEit Transfer

Vendor: Progress Software Corporation
Software: MOVEit Transfer
Software CPE: cpe:2.3:a:progress_software_corporation:moveit_transfer:*:*:*:*:*:*:*:*
Website: https://www.progress.com/
Total vulnerabilities: 17
Public exploits: 3
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting MOVEit Transfer MOVEit Transfer is affected by 17 known vulnerabilities: 2 critical, 5 high, 6 medium, 4 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137153 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-11903		 CWE-79 Low
No
No
 2025.0.8, 2025.1.4, 2026.0.1 08.07.2026 SB2026070875
#VU137154 - Improper Neutralization of Special Elements in Data Query Logic
CVE-2026-10698		 CWE-943 Low
No
No
 2025.0.8, 2025.1.4, 2026.0.1 08.07.2026 SB2026070875
#VU137155 - Missing release of memory after effective lifetime
CVE-2026-10699		 CWE-401 Medium
No
No
 2025.0.8, 2025.1.4, 2026.0.1 08.07.2026 SB2026070875
#VU117936 - Resource exhaustion
CVE-2025-10932		 CWE-400 Medium
No
No
 2023.1.16, 2024.1.7, 2025.0.3 03.11.2025 SB2025110343
#VU93368 - Improper Authentication
CVE-2024-5806		 CWE-287 Critical
Available
Exploited
 2023.0.11, 2023.1.6, 2024.0.2 26.06.2024 SB2024062616
#VU78056 - Uncaught Exception
CVE-2023-36933		 CWE-248 Medium
No
No
 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, 2023.0.4 10.07.2023 SB2023071035
#VU78055 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-36932		 CWE-89 Medium
No
No
 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, 2023.0.4 10.07.2023 SB2023071035
#VU78054 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-36934		 CWE-89 High
No
No
 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, 2023.0.4 10.07.2023 SB2023071035
#VU77455 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-35708		 CWE-89 High
No
No
 2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6, 2022.1.7, 2023.0.3 16.06.2023 SB2023061603
#VU77173 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-35036		 CWE-89 High
No
No
 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, 2023.0.2 13.06.2023 SB2023061231
#VU76765 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-34362		 CWE-89 Critical
Available
Exploited
 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, 2023.0.1 02.06.2023 SB2023060205
#VU53659 - Missing Authentication for Critical Function
CVE-2019-18465		 CWE-306 High
No
No
 2019.1.3 30.05.2021 SB2019103128
#VU53658 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-18464		 CWE-89 High
No
No
 2018.3, 2019.0.4, 2019.1.3 30.05.2021 SB2019103128
#VU53657 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-28647		 CWE-79 Low
No
No
 2020.1 30.05.2021 SB2020111736
#VU53656 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-31827		 CWE-89 Medium
Available
No
 2021.0 30.05.2021 SB2021053003
#VU25468 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-8611		 CWE-89 Medium
No
No
 2019.1.4, 2019.2.1 19.02.2020 SB2020021917
#VU25459 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-8612		 CWE-79 Low
No
No
 2019.1.4, 2019.2.1 19.02.2020 SB2020021917