Progress MOVEit Transfer vulnerabilities

The SFTP module of Progress MOVEit Transfer contains an incorrect implementation of the authentication algorithm. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The Custom Reports module of Progress MOVEit Transfer is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Progress MOVEit Transfer contains an insecure storage of sensitive information vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Progress MOVEit Transfer contains an improper handling of Unicode encoding vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Progress MOVEit Transfer contains an insufficient session expiration vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The Client Certificates module of Progress MOVEit Transfer contains an incorrect authorization vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The LDAP module of Progress MOVEit Transfer is vulnerable to LDAP injection due to improper neutralization of special elements in LDAP queries. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The OIDC module of Progress MOVEit Transfer contains an authentication bypass by capture-replay vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The Ad Hoc module of Progress MOVEit Transfer contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The LDAP module of Progress MOVEit Transfer contains a missing critical step in authentication vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Path equivalence vulnerability in the File Upload module of Progress MOVEit Transfer allows potential security bypass. Affects versions before 2025.0.8 and from 2025.1.0 before 2025.1.4.

Incorrect authorization vulnerability in the Audit User module of Progress MOVEit Transfer. The flaw allows unauthorized access to user audit functions.

Relative path traversal vulnerability in the Admin Settings module of Progress MOVEit Transfer. Allows an attacker to access files outside the intended directory.

An improper neutralization of special elements in data query logic vulnerability exists in Progress MOVEit Transfer (Custom Reports modules). Affected versions are before 2025.0.7 and from 2025.1.0 before 2025.1.3.

An XSS vulnerability was found in the Ad Hoc module of Progress MOVEit Transfer due to improper input neutralization during page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.

A missing release of memory after effective lifetime vulnerability has been found in the Custom Reports module of Progress MOVEit Transfer. It affects versions 2025.0.0 before 2025.0.8, 2025.1.0 before 2025.1.4, and 2026.0.0 before 2026.0.1.

A vulnerability in Progress MOVEit Transfer's Custom Reports module involves improper neutralization of special elements in data query logic. This allows an attacker to manipulate queries, potentially leading to unauthorized data access.