CVE-2023-35708: Progress MOVEit Transfer SQL injection allows unauthenticated database access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with an EPSS near 0.97, makes this an urgent patch-first issue.

What it is

Progress MOVEit Transfer contains a SQL injection flaw in its web application that lets an unauthenticated attacker reach the backend database. A crafted payload sent to a MOVEit Transfer endpoint can modify and disclose database content. Because the affected product is widely used for managed file transfer, exposed instances are a high-value target.

Impact

An attacker can read and alter MOVEit Transfer database contents without valid credentials. That exposes stored file-transfer metadata and potentially sensitive records, and allows tampering with application data.

Attack surface

Reachable over the network through the MOVEit Transfer web application endpoint; the CVSS vector shows no privileges and no user interaction required. Any internet-facing or otherwise reachable instance is exposed.

Exploitation

EPSS is very high (0.96682, 99.88th percentile), indicating strong likelihood of exploitation activity, but the record is not listed in CISA KEV and the references carry only vendor advisory, mitigation, patch and government advisory tags, so no confirmed in-the-wild exploitation is stated here.

What to do

• Apply the fixed DLL drop-in versions listed by Progress (2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6, 2022.1.7, 2023.0.3) immediately.
• If patching cannot be done at once, follow the vendor mitigation guidance in the Progress advisory, including restricting or disabling external access to the MOVEit Transfer web interface.
• Remove internet exposure of MOVEit Transfer where operationally possible and place it behind access controls or a VPN.
• Review database and application logs for unexpected SQL activity or anomalous requests to MOVEit endpoints.
• Rotate credentials and secrets stored in or accessible from the MOVEit Transfer database if compromise is suspected.

Detection

• Inspect web server and application logs for malformed or SQL-like payloads sent to MOVEit Transfer endpoints.
• Monitor database logs for unusual queries, schema changes or bulk data reads originating from the MOVEit application account.
• Alert on unexpected outbound connections or file writes from the MOVEit Transfer host.
• Baseline normal MOVEit endpoint request patterns and flag deviations, especially unauthenticated requests with unusual parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.