MT
File Transfer
MOVEit Transfer
On CISA KEVExploited in the wildRansomware-linked
50
CVEs
1
On KEV
9.8
Max CVSS
12
New 30D
Severity mix
Critical 15High 27Medium 8Low 0
Watch
Add MOVEit Transfer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-6217 | 6.1 | Nov 29 | MOVEit Transfer XSS via MOVEit Gateway Affected: 2023.0.0 (15.0.0) before 2023.0.7 (15.0.7); 2022.1.0 (14.1.0) before 2022.1.10 (14.1.10); 2022.0.0 (14.0.0) before 2022.0.9 (14.0.9) |
| CVE-2023-42656 | 6.1 | Sep 20 | MOVEit Transfer Reflected XSS Affected: 2023.0.0 (15.0.0) before 2023.0.6 (15.0.6); 2022.1.0 (14.1.0) before 2022.1.9 (14.1.9); 2022.0.0 (14.0.0) before 2022.0.8 (14.0.8); 2021.1.0 (13.1.0) before 2021.1.8 (13.1.8) |
| CVE-2026-89069 | 5.4 | Oct 14 | MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages Affected: before 2025.1.6; 2026.0.0 before 2026.0.4 |
| CVE-2026-15968 | 5.4 | Jul 23 | Stored XSS vulnerability in MOVEit Transfer Affected: before 2025.1.5; 2026.0.0 before 2026.0.3 |
| CVE-2026-11903 | 5.4 | Jul 8 | Stored XSS in MOVEit Transfer Ad Hoc module Affected: 2026.0.0 before 2026.0.1; 2025.1.0 before 2025.1.4; 2025.0.0 before 2025.0.8 |
| CVE-2020-28647 | 5.4 | Nov 17 | In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application Affected: before 2020.1 |
| CVE-2025-13147 | 5.3 | Nov 19 | External Service Interaction (DNS) Affected: before 2024.1.8; 2025.0.0 before 2025.0.4 |
| CVE-2024-2291 | 4.3 | Mar 20 | MOVEit Transfer Logging Bypass Vulnerability Affected: 2022.0.0 (14.0.0) before 2022.0.11 (14.0.11); 2022.1.0 (14.1.0) before 2022.1.12 (14.1.12); 2023.0.0 (15.0.0) before 2023.0.9 (15.0.9); 2023.1.0 (15.1.0) before 2023.1.4 (15.1.4) |
Showing 8