CVE-2024-5806criticalobserved exploitationCWE-287

CVE-2024-5806: critical vulnerability in Progress MOVEit Transfer

MOVEit Transfer Authentication Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor MOVEit Transfer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.1epss 81%
from disclosure to weaponsame day
Published on NVDJun 25
1st PoCJun 24
metasploitJun 25
VulnCheckJun 25
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Progress · MOVEit Transfer
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Progress MOVEit Transfer

In the same product, most dangerous first.

CVE-2026-10698HIGHTable scope bypass vulnerability in custom reportsEPSS 0.6%CVE-2024-6576HIGHMOVEit Transfer Privilege Escalation VulnerabilityEPSS 0.6%CVE-2026-8650MEDIUMAuthenticated Path Traversal allows MOVEit admins to view arbitrary system filesEPSS 0.6%CVE-2026-10697HIGHMFA Bypass in MOVEit TransferEPSS 0.6%CVE-2026-8801LOWFile Extension Restriction Bypass in MOVEit TransferEPSS 0.5%CVE-2026-89068HIGHMOVEit Transfer Authentication bypass in LDAP sign-onEPSS 0.5%