CVE-2023-36934: Progress MOVEit Transfer SQL injection allows unauthenticated database access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.1 with network reachability, no authentication and high confidentiality and integrity impact, combined with a very high EPSS probability, makes this an urgent patch.

What it is

MOVEit Transfer versions before the listed 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8 and 2023.0.4 service packs contain a SQL injection flaw in the web application. An unauthenticated attacker can send a crafted payload to an application endpoint, potentially reading and modifying database content. This matters because MOVEit Transfer is an internet-facing managed file transfer product, so the flaw is remotely reachable without credentials.

Impact

An attacker can gain unauthorized access to the MOVEit Transfer database, leading to disclosure and modification of stored data. The CVSS vector rates confidentiality and integrity impact as high, with no availability impact.

Attack surface

Reached over the network through a MOVEit Transfer web application endpoint; the CVSS vector shows no privileges required and no user interaction. No authentication is needed per the description.

Exploitation

The record is not listed in CISA KEV and no ransomware groups are documented for it, but EPSS is very high at 0.95184 (99.862 percentile), indicating a strong likelihood of attempted exploitation. References are patch notes and product pages only, with no public exploit tag.

What to do

• Apply the vendor service pack that fixes the issue: 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8) or 2023.0.4 (15.0.4).
• If immediate patching is not possible, restrict network access to MOVEit Transfer web endpoints to trusted sources only.
• Review MOVEit Transfer database accounts for least privilege and remove unnecessary write permissions.
• Monitor vendor advisories for any follow-up guidance on this SQL injection issue.

Detection

• Inspect web server and MOVEit Transfer logs for SQL metacharacters or injection patterns in request parameters to application endpoints.
• Alert on unexpected database queries or errors originating from the MOVEit Transfer application.
• Baseline and monitor database write activity from the MOVEit Transfer service account for anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.