{"id":"CVE-2024-5806","published":"2024-06-25T15:04:37Z","modified":"2024-08-01T21:25:02Z","title":"MOVEit Transfer Authentication Bypass Vulnerability","vendor":"Progress","product":"MOVEit Transfer","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress","product":"MOVEit Transfer","versions":[">= 2023.0.0, < 2023.0.11",">= 2023.1.0, < 2023.1.6",">= 2024.0.0, < 2024.0.2"]}],"description":{"text":"Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.","provenance":"source","from":"CVE.org"},"summary":{"text":"The MOVEit Transfer product from Progress has an improper authentication flaw in its SFTP module that can lead to an authentication bypass. An attacker with network access can exploit it without credentials or user interaction, gaining unauthorised access with high impact to confidentiality and integrity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:39Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.81474,"percentile":0.99638,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-06-25","exploitedFirstSeen":"2024-06-25","ransomware":false,"evidence":[{"url":"https://www.linkedin.com/feed/update/urn:li:activity:7211444166466142210/","date":"2024-06-25"},{"url":"https://www.tenable.com/blog/cve-2024-5806-progress-moveit-transfer-authentication-bypass-vulnerability","date":"2024-06-25"},{"url":"https://x.com/Shadowserver/status/1805676078620401831","date":"2024-06-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-26&host_type=src&vulnerability=cve-2024-5806","date":"2024-06-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-27&host_type=src&vulnerability=cve-2024-5806","date":"2024-06-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-28&host_type=src&vulnerability=cve-2024-5806","date":"2024-06-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-02&host_type=src&vulnerability=cve-2024-5806","date":"2024-07-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-04&host_type=src&vulnerability=cve-2024-5806","date":"2024-07-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-05&host_type=src&vulnerability=cve-2024-5806","date":"2024-07-05"},{"url":"https://www.ptsecurity.com/ru-ru/research/analytics/aktualnye-kiberugrozy-ii-kvartal-2024-goda/","date":"2024-08-22"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"Credit AlienVault | clone ' We're not talking about cryptocurrency as much as we '","url":"https://otx.alienvault.com/pulse/6a7f9c58badab1f056432178","created":"2026-08-14"},{"name":"Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT","url":"https://otx.alienvault.com/pulse/66aa153b000fe60e6fb7e7df","created":"2024-07-31"},{"name":"eSentire | Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT","url":"https://otx.alienvault.com/pulse/66a9dc385e9a61bdfee6a4d2","created":"2024-07-31"},{"name":"eSentire | Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT","url":"https://otx.alienvault.com/pulse/66a765979f4aef2a326ae999","created":"2024-07-29"},{"name":"eSentire | Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAT","url":"https://otx.alienvault.com/pulse/66a74deb8ae7dc0919fab86a","created":"2024-07-29"},{"name":"eSentire | Exploring the Infection Chain: ScreenConnect’s Link to…","url":"https://otx.alienvault.com/pulse/6687f19eff15590621dd48ba","created":"2024-07-05"},{"name":"eSentire | Fake IT Support Website Leading to Vidar Infection","url":"https://otx.alienvault.com/pulse/6682ac0355982625657327e7","created":"2024-07-01"},{"name":"eSentire | Fake IT Support Website Leading to Vidar Infection","url":"https://otx.alienvault.com/pulse/6682abf4fd4b3b7f10a778a3","created":"2024-07-01"},{"name":"We're not talking about cryptocurrency as much as we used to, but there are still plenty of scammers out there","url":"https://otx.alienvault.com/pulse/667e67d37bd6cbcb85853618","created":"2024-06-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://www.progress.com/moveit","tags":["product"]},{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Product-Security-Alert-Bulletin-June-2024-CVE-2024-5806","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-46954","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46954","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-06-24","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806","repos":[{"name":"watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806","url":"https://github.com/watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806","stars":45,"created":"2024-06-24"},{"name":"sec13b/CVE-2024-5806","url":"https://github.com/sec13b/CVE-2024-5806","stars":0,"created":"2025-03-08"}]},"metasploit":[{"name":"Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read","module":"auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806","type":"auxiliary","disclosureDate":"2024-06-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806.rb"}],"first":{"date":"2024-06-24","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2024-06-25","url":"https://github.com/watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806","provenance":"source"},{"date":"2024-06-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-5806","provenance":"source"},{"date":"2024-06-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.linkedin.com/feed/update/urn:li:activity:7211444166466142210/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 857 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9964"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}