CVE-2026-10697— MFA Bypass in MOVEit Transfer
Quick assessment
Affected
Progress MOVEit Transfer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress MOVEit Transfer是Progress公司的一款文件传输软件。 Progress MOVEit Transfer 2025.1.5之前版本和2026.0.0至2026.0.3之前版本存在授权问题漏洞，该漏洞源于身份验证不当，可能允许攻击者绕过身份验证。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress | MOVEit Transfer | < 2025.1.5 |
affected |
2026.0.0< 2026.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10697
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MFA Bypass in MOVEit Transfer
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Authentication vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Progress MOVEit Transfer 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress MOVEit Transfer是Progress公司的一款文件传输软件。 Progress MOVEit Transfer 2025.1.5之前版本和2026.0.0至2026.0.3之前版本存在授权问题漏洞，该漏洞源于身份验证不当，可能允许攻击者绕过身份验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress | MOVEit Transfer | 0 ~ 2025.1.5 | - |
|
II. Public POCs for CVE-2026-10697
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10697
请登录查看更多情报信息。
Vendor Pages for CVE-2026-10697 (1)
-
🔗 Fixed Issues in 2026.0.3 release-notes
Same Patch Batch · Progress · 2026-07-23 · 4 CVEs total
| CVE-2026-15966 | 7.5 HIGH | Improper CORS handling in MOVEit Transfer |
| CVE-2026-15967 | 7.5 HIGH | MOVEit Transfer refresh-token processing does not enforce updated account restrictions |
| CVE-2026-15968 | 7.1 HIGH | Stored XSS vulnerability in MOVEit Transfer |
IV. Related Vulnerabilities
Same product: MOVEit Transfer
-
CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer -
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up -
CVE-2026-15966
Improper CORS handling in MOVEit Transfer -
CVE-2026-8801
File Extension Restriction Bypass in MOVEit Transfer -
CVE-2026-8800
Cross-Org External Token Metadata accessible to AuditUser ro
Same vendor: Progress
-
CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi -
CVE-2026-16138
Remote code execution via unsafe deserialization in Progress -
CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil -
CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer -
CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up
Same weakness: CWE-287
-
CVE-2026-97637
JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypa -
CVE-2026-19660
Divi Membership <= 2.3.0 - Unauthenticated Authentication By -
CVE-2026-14378
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass -
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command In -
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue
V. Comments for CVE-2026-10697
No comments yet