ACTIVELY EXPLOITED
CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability
| Vendor | Progress |
|---|---|
| Product | MOVEit Transfer |
| Actively exploited | Yes |
| Added to CISA KEV | 2 Jun 2023 |
| CISA federal deadline | 23 Jun 2023 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-89 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
SOURCES
Other Progress flaws
- CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability
- CVE-2024-4885: Progress WhatsUp Gold Path Traversal Vulnerability
- CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability
- CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability
- CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.