The vulnerability is a missing critical step in authentication within the LDAP module of Progress MOVEit Transfer, classified as a CWE‑304 weakness. This defect allows an attacker to bypass standard authentication controls when logging in via LDAP, granting unauthorized access to the application.

The affected product is Progress MOVEit Transfer. Versions prior to 2025.1.6 and versions from 2026.0.0 through 2026.0.3 are vulnerable. All deployments utilizing the LDAP sign-on feature in these releases are at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score of < 1% indicates a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers likely must reach the MOVEit Transfer web interface to exploit the LDAP authentication bypass. Once exploited, the attacker gains the same privileges as the authenticated user, leading to potential system compromise. The fixed versions address the missing authentication step.