MOVEit Transfer: Incorrect authentication algorithm in SFTP module

Summary

Progress MOVEit Transfer contains an incorrect implementation of an authentication algorithm in its SFTP module (CWE-303). An attacker with network access and a valid low-privilege SFTP account could exploit it to gain unauthorized access, with high impact on confidentiality, integrity and availability. The vendor bulletin lists the same fixed versions but gives a CVSS score of 7.5, while the NVD record used here shows 8.8.

Affected

• MOVEit Transfer before 2025.1.6
• MOVEit Transfer 2026.0.0 to before 2026.0.4
• Unclear: MOVEit Transfer 2025.0.x is listed in the vendor bulletin but not in the CVE record. Confirm with Progress.

Fixed in

• Upgrade to MOVEit Transfer 2025.1.6 for the 2025.1.x branch
• Upgrade to MOVEit Transfer 2026.0.4 for the 2026.0.x branch

Workaround

Unknown. No vendor-published workaround found; the vendor recommends upgrading. Only excerpts of the bulletin were available, so check the full bulletin for interim mitigations.

Exploitation

• No evidence of in-the-wild exploitation found; the bulletin does not state whether exploitation occurred.
• CISA SSVC assessment: exploitation none.
• Not listed in CISA KEV according to a third-party tracker (not verified directly).
• No public proof of concept found.

Our recommendation

• Identify all MOVEit Transfer instances, including 2025.0.x, and confirm their versions in the License tab of the Config utility.
• Upgrade to 2025.1.6 or 2026.0.4, or to the latest active release. Patch the whole release, as the bulletin contains nine other CVEs.
• Review SFTP accounts, remove unused ones, and restrict internet exposure of SFTP where possible.
• Review logs for unusual SFTP logins from the affected period.
• Recheck the NVD score and the Progress bulletin for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Progress bulletin (primary) community.progress.com
• Vulnrichment mirror of CNA record vulners.com
• gbhackers bulletin summary gbhackers.com
• Cyberpress exploitation status cyberpress.org
• OpenCVE app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:44.