An incorrect implementation of the authentication algorithm within the SFTP module of Progress MOVEit Transfer allows an attacker who can connect to the SFTP service to authenticate as any user or bypass identity checks. The flaw grants unauthorized access to the file transfer service and potentially all resources that the service can expose. The weakness is identified as CWE‑303: Improper Authentication.

Systems running Progress MOVEit Transfer before version 2025.1.6, or any release starting at 2026.0.0 but prior to 2026.0.4, are vulnerable to this flaw. Only these specific version ranges are affected; later releases are not impacted according to the vendor’s advisory.

The CVSS score of 7.5 indicates a high level of risk, and the EPSS score of < 1% suggests a very low probability of exploitation at present. Based on the description, the likely attack vector involves an attacker connecting to the SFTP service, though the exact vector is not explicitly stated. Although it is not listed in the CISA KEV catalog, organizations that expose MOVEit Transfer to the internet or use it for critical data exchange face a serious concern. A successful exploit could allow an attacker to gain read/write access to sensitive files and compromise the integrity and confidentiality of the transferred data.