Threats affecting pkg:maven/com.ipswitch/moveit-transfer

CVE-2026-89076 is a high-severity SQL injection vulnerability in the Custom Reports module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and from 2026.0.0 up to but not including 2026.0.4. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to full confidentiality, integrity, and availability compromise. No known exploits are reported in the wild. The CVSS score is 7.2, indicating a significant risk if exploited.

CVE-2026-89075 is a high-severity vulnerability in Progress MOVEit Transfer involving insecure storage of sensitive information. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a CVSS score of 7.3, indicating significant confidentiality, integrity, and availability impacts. No vendor advisory or patch information is provided in the input data.

CVE-2026-89072 is an Incorrect Authorization vulnerability in the Client Certificates module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a high severity with a CVSS score of 7.5, indicating it can lead to high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor has not provided explicit patch links or advisories in the provided data.

CVE-2026-89070 is an authentication bypass vulnerability in the OpenID Connect (OIDC) module of Progress MOVEit Transfer. It allows an attacker to bypass authentication by replaying captured authentication data. The vulnerability affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The issue has a high severity rating with a CVSS score of 7.5. No known exploits in the wild have been reported. No explicit patch links are provided in the data.

CVE-2026-87093 is a high-severity vulnerability in Progress MOVEit Transfer involving incorrect permission assignment for a critical resource. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability can lead to complete confidentiality, integrity, and availability compromise of the affected system.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.

CVE-2023-34362 is a critical SQL injection vulnerability affecting multiple versions of the MOVEit Transfer web application prior to specific patched releases. This flaw allows unauthenticated attackers to execute arbitrary SQL commands against the MOVEit Transfer database, potentially leading to full compromise of data confidentiality, integrity, and availability. Exploitation can occur remotely over HTTP or HTTPS without any authentication or user interaction, making it highly accessible. The vulnerability has been actively exploited in the wild during May and June 2023. Affected versions include all releases before 2021.0.6, 2021.1.4, 2022.0.