The flaw is an incorrect authorization bug in the Client Certificates module of Progress MOVEit Transfer. It can allow an adversary to bypass normal access controls and create, modify, or delete client certificates that the system uses for authentication. Because certificates are critical to the secure operation of MOVEit Transfer, this could enable unauthorized data transfer, masquerade as legitimate users, or disrupt secure communications.

The vulnerability affects all installations of Progress MOVEit Transfer running a version prior to 2025.1.6, and also those that are on the 2026.0.0 series before the release of 2026.0.4.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires authenticated access or an exposed administrative interface, and attackers could exploit the weakness by sending specially crafted requests to the Client Certificates API to elevate privileges or modify certificates. Organizations should evaluate whether exposed client‑certificate management functions are necessary in their environment and weigh the risk of potential exploitation.