The vulnerability results from improper handling of Unicode character encoding within the email MFA workflow of Progress MOVEit Transfer. Test inputs containing Unicode characters can be interpreted incorrectly, allowing an attacker to forge or tamper with the authentication process and bypass the required MFA step. If an attacker successfully exploits this flaw, they can gain authenticated access to the Transfer system and retrieve or manipulate protected data without authorization, affecting the confidentiality and integrity of the transferred files.

The affected product is Progress MOVEit Transfer. Vulnerable versions are all releases prior to 2025.1.6, as well as the 2026.0.x series prior to 2026.0.4 (i.e., 2026.0.0 through 2026.0.3). All other newer versions are not impacted.

The CVSS score of 7.5 indicates a high level of risk. Although the EPSS score is less than 1%, the absence of a KEV listing does not preclude the potential for exploitation, especially if the system is exposed to unauthenticated users with the ability to submit MFA requests. The likely attack vector is remote, via the web interface or API that processes MFA email submissions. Attackers would need to craft Unicode-encoded input that the system misinterprets, thereby bypassing the MFA challenge. Given the high severity and the relatively wide range of affected versions, the risk to organizations running these releases is significant.