Vulnerability record · CVE-2023-36933 · published 5 July 2023
CVE-2023-36933: MOVEit Transfer unhandled exception allows remote denial of service
Progress · Moveit Transfer
MOVEit Transfer before the listed 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8 and 2023.0.4 builds allows an attacker to invoke a method that triggers an unhandled exception. The workflow can cause the MOVEit Transfer application to terminate unexpectedly, disrupting file transfer services.
Description
In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 availability-only remote DoS with no authentication required, and a very high EPSS percentile, though no confirmed exploitation or KEV listing.
What it is
MOVEit Transfer before the listed 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8 and 2023.0.4 builds allows an attacker to invoke a method that triggers an unhandled exception. The workflow can cause the MOVEit Transfer application to terminate unexpectedly, disrupting file transfer services.
Impact
An unauthenticated remote attacker can crash the MOVEit Transfer application, causing a denial of service. There is no stated impact on confidentiality or integrity, only availability.
Attack surface
Reachable over the network per the CVSS vector AV:N/PR:N/UI:N, so no authentication or user interaction is required. The description does not specify the exact endpoint or method invoked.
Exploitation
Not listed in CISA KEV and no ransomware association is documented; EPSS is high at 0.72242 (99.4th percentile), but references are only vendor release notes and product pages, so no public exploit is confirmed by this record.
What to do
- Upgrade MOVEit Transfer to 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, 2023.0.4 or later as listed in the vendor advisory.
- If immediate patching is not possible, restrict network access to the MOVEit Transfer service to trusted sources only.
- Monitor the service for unexpected restarts or crashes and alert on repeated termination events.
- Review vendor release notes for any additional hardening guidance tied to this fix.
Detection
- Alert on MOVEit Transfer process termination or unexpected service restarts in application and Windows event logs.
- Baseline normal request patterns and flag anomalous or malformed requests to MOVEit endpoints that precede a crash.
- Correlate availability monitoring gaps with source IPs hitting the MOVEit Transfer service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 | Release NotesVendor Advisory |
| https://www.progress.com/moveit | Product |
| https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023 | Release NotesVendor Advisory |
| https://www.progress.com/moveit | Product |
Track CVE-2023-36933 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-36933), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
