CVE-2024-5806

CriticalPublished

MOVEit Transfer Authentication Bypass Vulnerability

Published: Jun 25, 2024
Updated: Aug 1, 2024
Assigning CNA: ProgressSoftware
Evidence observed: Aug 4, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

81.5%

High · next 30 days

Percentile: 99.6%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

Progress MOVEit SFTP Authentication Bypass for Arbitrary File ReadModule
modules/auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806.rb
Metasploit Framework modules
ResearchEvidence observed: Sep 25, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- verification: check_declared($.auxiliary_gather/progress_moveit_sftp_fileread_cve_2024_5806.check)

watchTowr-vs-progress-moveit_CVE-2024-5806Exploit
Exploit for the CVE-2024-5806
CVE-2024-5806PoC

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.