CVE-2025-11235VulnerabilityPublished 6 Jan 2026

CVE-2025-11235: Progress MOVEit Transfer · Unverified Password Change

Affects Progress MOVEit TransferSource CVE Database V5

Not known to be exploited · CVSS 3.7 Low · fixed in 2023.1.3 : update Progress MOVEit Transfer when convenient.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

3.7Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2023.1.3, 2023.0.8, 2022.1.11 +1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Progress MOVEit Transfer to 2023.1.3, 2023.0.8, 2022.1.11 or 2022.0.10.

Affected software

Product	Affected	Fixed in
ProgressMOVEit Transfer	Affected >=2023.1.0 <2023.1.3 >=2023.0.0 <2023.0.8 >=2022.1.0 <2022.1.11 >=2022.0.0 <2022.0.10	Fixed in 2023.1.3 2023.0.8 2022.1.11 2022.0.10

AI-suggested

1. 2. Restrict network access to the REST API endpoints by implementing firewall rules or network segmentation to limit exposure only to trusted management and integration systems. 3. Monitor logs and audit trails for unusual or repeated password change requests, especially those originating from unexpected IP addresses or outside normal operational hours. 4. Enforce strong authentication and authorization controls around administrative interfaces to reduce the risk of unauthorized access attempts. 5. Consider implementing multi-factor authentication (MFA) for administrative accounts to add an additional layer of verification. 6. Regularly review and update MOVEit Transfer configurations to disable or limit unnecessary API functionalities. 7. Conduct internal security awareness and incident response drills to prepare for potential service disruptions. 8. Engage with Progress support channels for guidance and early access to patches or workarounds. These steps go beyond generic advice by focusing on network-level protections, monitoring, and operational readiness specific to the MOVEit Transfer environment.

Description

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

Impact

For European organizations, the primary impact of CVE-2025-11235 lies in potential availability disruptions of MOVEit Transfer services. Since MOVEit Transfer is commonly used for secure file transfers in sectors such as finance, government, healthcare, and critical infrastructure, any service interruption could delay sensitive data exchanges and operational workflows. Although the vulnerability does not compromise confidentiality or integrity, denial of service or administrative confusion caused by unauthorized password changes could lead to temporary loss of access or increased support overhead. Organizations with high dependency on MOVEit Transfer for compliance-driven data transfers may face regulatory scrutiny if service disruptions affect data delivery timelines. The low severity and high attack complexity reduce immediate risk, but unpatched systems remain vulnerable to targeted disruption attempts. European entities operating MOVEit Transfer in multi-tenant or cloud environments should be cautious of potential lateral impacts if attackers exploit this flaw to cause cascading service interruptions.

CWE-620Unverified Password Change (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the…
OWASP Cheat Sheets
Choosing and Using Security Questions (opens in a new tab)
Forgot Password (opens in a new tab)
Credential Stuffing Prevention (opens in a new tab)
Authentication (opens in a new tab)
Transport Layer Protection (opens in a new tab)
OWASP ASVS 4.0.3
V2.1.6 (opens in a new tab)
V2.2.3 (opens in a new tab)
V2.1.5 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

docs.progress.com/bundle/moveit-transfer-release-notes-2023_1/page/Fixed-Issues-in-2023.1.3.html (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jan 2026, 01:37 UTC

WeaknessesCWE-620

Technical details

References

Community reviews

Related threats