Improper neutralization of special elements used in an LDAP query allows an LDAP injection attack. An attacker could use crafted input during certificate-based authentication to read or modify LDAP directory data, potentially bypassing authentication or exfiltrating sensitive information.

The vulnerability affects Progress MOVEit Transfer platforms that are earlier than version 2025.1.6 and those ranging from 2026.0.0 through 2026.0.3. Upgrades to 2025.1.6, 2025.1.7 or later versions in the 2026.0 series are required to eliminate the flaw.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1%, and the vulnerability has not been listed in the CISA KEV catalog. Attackers would need to target the LDAP authentication mechanism, sending malicious input over the network. The lack of exploit availability data suggests no confirmed real‑world exploitation yet, but the high severity and potential for data disclosure recommend prompt action.