Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-10697: MOVEit Transfer MFA Bypass Allows Unauthorized Access

CVE-2026-10697 · published 3 months ago

Summary

MOVEit Transfer, a file transfer software, has a security flaw that allows attackers to bypass its multi-factor authentication (MFA) feature. This means that even with MFA enabled, unauthorized users may be able to access and manipulate files. If you're using MOVEit Transfer, make sure to update to the latest version (2025.1.5 or later, or 2026.0.3 or later) to fix this issue.

What to do

Update progress moveit transfer to version 2025.1.5 or later.

Affected software

Vendor	Product	Affected versions
progress	moveit transfer	< 2025.1.5
progress	moveit_transfer	< 2025.1.5 >= 2026.0.0, < 2026.0.3 `cpe:2.3:a:progress:moveit_transfer::::::::`

Original advisory text

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Improper Authentication vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-I... release-notes

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published23 Jul 2026

Updated4 Nov 2026

First seen23 Jul 2026

Sources

CVE-2026-10697 · NVD

CVE-2026-10697 · MITRE

Track software like this

Free during beta