Loading story…
A critical pre-authentication flaw in Progress MOVEit Transfer, CVE-2023-34362, was actively exploited to compromise internet-facing managed file-transfer servers and steal customer data. The vulnerability allowed SQL injection over HTTP/HTTPS, enabling attackers to manipulate the database, establish privileged sessions, deploy the human2.aspx ASPX webshell, and access or exfiltrate stored files. Microsoft attributed the campaign to Lace Tempest, associated with the Cl0p extortion ecosystem; Cl0p subsequently demanded that victims make contact or face publication of stolen data.
Technical analysis found that duplicate HTTP-header smuggling could bypass MOVEitISAPI.dll transaction restrictions and set attacker-controlled session variables. Those values reached vulnerable guest-access code, permitting creation of a sysadmin session, acquisition of an API token, and a path to remote code execution through resumable-upload metadata and unsafe .NET BinaryFormatter deserialization. Organizations were urged to apply Progress updates, restrict HTTP/HTTPS exposure until patched, hunt for human2.aspx, the Health Check Service account or session, and X-siLock-* headers, preserve logs, rotate relevant storage credentials, and rebuild compromised servers from trusted backups because patching alone does not remove persistence.
See which actors are running it and whether you're in range.
11 events from the most recent confirmed update back to the earliest known activity.
Rapid7 reported exploitation across multiple customer environments, including the human2.aspx webshell in the MOVEit wwwroot directory. The webshell used an X-siLock-Comment header check and appeared across multiple victims, indicating automated exploitation.
Progress Software issued a security bulletin for a critical MOVEit Transfer SQL-injection vulnerability, subsequently tracked as CVE-2023-34362, and published mitigations and fixed versions.
Evidence showed human2.aspx backdoors had been uploaded to public MOVEit sites since May 28, while Rapid7 confirmed data exfiltration dating to at least that date.
Rapid7 confirmed indicators of compromise associated with the MOVEit Transfer zero-day dating back to at least May 27, 2023.
Researchers detailed a chain using duplicate-header smuggling to reach unsanitized session variables and SQL injection, then creating an active sysadmin session and abusing BinaryFormatter deserialization in resumable-upload metadata to achieve remote code execution.
Microsoft attributed the MOVEit Transfer zero-day campaign to Lace Tempest, a threat actor previously linked to the Cl0p ransomware, data-theft, and extortion ecosystem.
Progress disclosed and patched CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933.
Progress disclosed a third MOVEit Transfer vulnerability, assigned CVE-2023-35708.
Progress released a patch for CVE-2023-35036, a second SQL-injection issue affecting all MOVEit Transfer versions. It was not known to be exploited in the wild at the time.
The Cl0p gang posted a leak-site message directing victims to contact the group by June 14 to negotiate payment for deletion of stolen data.
Progress advised MOVEit users to download patches only through Progress knowledge-base articles rather than third-party sources.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourcerapid7.com
Open sourcetrustedsec.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed and patched two vulnerabilities in **MOVEit Automation**, including **`CVE-2026-4670`**, a critical authentication-bypass flaw, and **`CVE-2026-5174`**, a high-severity privilege-escalation issue. The company warned that successful exploitation could let attackers access business data, gain administrative control, and expose sensitive information in the managed file transfer platform. Progress said customers must upgrade to the latest version using the **full installer** and shut down the software during the upgrade process to fully remediate the flaws. External exposure appears significant. Internet scanning cited by Cybersecurity Dive found more than **1,440** internet-connected systems running vulnerable MOVEit Automation versions, including **16** associated with state and local government agencies, while Censys separately issued an advisory tracking **`CVE-2026-4670`**. The disclosure drew added attention because MOVEit products have previously been targeted in high-impact exploitation campaigns, increasing concern that exposed and unpatched systems could become immediate targets.
Jun 29, 2026
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability, **CVE-2024-5806**, warning that a threat actor could exploit the flaw to take control of affected systems. CISA urged organizations to review Progress Software’s June 2024 alert and apply updates, while reporting indicated the bug was being attacked within hours of public disclosure, raising the risk of rapid compromise for internet-exposed file-transfer servers. The new exploitation wave revived scrutiny of the earlier MOVEit crisis, when the Clop ransomware-linked extortion campaign compromised organizations across the private and public sectors. Reported victims and affected entities included technology and IT firms, state and federal agencies, schools tied to the Teachers Insurance and Annuity Association of America retirement fund, Norton LifeLock owner Gen Digital, Vancouver Transit Police, Missouri agencies, and Extreme Networks, underscoring how vulnerabilities in widely deployed managed file-transfer software can cascade into broad supply-chain and data-theft incidents.
Jun 29, 2026
Progress Software disclosed two critical vulnerabilities in **MOVEit Automation**, including **CVE-2026-4670**, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to **CWE-305** and included it in a security bulletin covering both **CVE-2026-4670** and **CVE-2026-5174**. The advisories affect multiple MOVEit Automation release branches, including versions prior to **2025.0.9**, **2024.1.8**, and releases before **2024.0.0**, with broader vendor and government guidance also referencing affected builds such as **2025.1.4 and earlier**, **2025.0.8 and earlier**, **2024.1.7 and earlier**, and **2024.0.0 and earlier**. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Jun 29, 2026