The vulnerability is a memory leak in the Custom Reports modules of MOVEit Transfer’s SFTP service. The application fails to release allocated memory after a transfer completes (CWE‑401). Each file transfer or report request allocates new memory that is never freed, gradually exhausting server RAM until the service becomes unresponsive or crashes. The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1 % shows that real‑world exploitation is rare. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can authenticate to the SFTP service may trigger the leak repeatedly without elevated privileges, leading to rapid resource exhaustion.

Progress MOVEit Transfer versions from 2025.0.0 up to 2025.0.7, from 2025.1.0 up to 2025.1.3, and from 2026.0.0 up to 2026.0.0 are affected. All later releases, specifically 2025.0.8 or later, 2025.1.4 or later, and 2026.0.1 or later, contain the necessary fix.

Based on the description, it is inferred that any authenticated SFTP user can trigger the leak from the network, making the flaw readily exploitable. The low EPSS score indicates few observed attacks, but the high CVSS score shows that a successful exploit would severely disrupt availability. An attacker can repeatedly upload or download files to exhaust memory, causing the service to crash or become unresponsive for legitimate users. No elevated privileges are required beyond SFTP authentication, and the vulnerability is not included in the CISA KEV catalog.