This vulnerability (CVE-2026-10697) in Progress MOVEit Transfer is classified as CWE-287 (Improper Authentication). It affects MOVEit Transfer versions prior to 2025.1.5 and versions from 2026.0.0 up to 2026.0.3. The issue allows unauthorized actors to bypass authentication mechanisms, potentially leading to full compromise of the system's confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.5, reflecting a high severity with attack vector being adjacent network, high attack complexity, no privileges required, no user interaction, and impacts on all three security properties (C, I, A). As of the published date, no official patch or fix has been documented, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication controls in MOVEit Transfer, leading to unauthorized access. This can result in full compromise of confidentiality, integrity, and availability of the affected system. The high CVSS score indicates significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Progress vendor advisories for updates. Until a patch is available, restrict access to MOVEit Transfer interfaces to trusted networks and users only, and apply any recommended temporary mitigations from the vendor once available.