CVE-2026-10697
published 2026-07-23CVE-2026-10697: Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.29%
22.0th percentile
Improper Authentication vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | moveit_transfer | < 2025.1.5 | 2025.1.5 |
| progress | moveit_transfer | >= 2026.0.0 < 2026.0.3 | 2026.0.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Progress MOVEit Transfer up to 2025.1.4/2026.0.2 improper authentication
vuldb·2026-07-23·CVSS 7.5
CVE-2026-10697 [HIGH] Progress MOVEit Transfer up to 2025.1.4/2026.0.2 improper authentication
A vulnerability, which was classified as critical, has been found in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. This vulnerability affects unknown code. Performing a manipulation results in improper authentication.
This vulnerability was named CVE-2026-10697. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
Improper Authentication vulnerability in Progress MOVEit Transfer.
ghsa_unreviewed·2026-07-23
CVE-2026-10697 [HIGH] CWE-287 Improper Authentication vulnerability in Progress MOVEit Transfer.
Improper Authentication vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-23
Published