CVE-2024-5806

—

CVSS 3.1

9.8 critical

EPSS

81%p100

Published

Jun 25, 2024 (Jun 25, 2024)

Modified

Jun 17, 2026

Description

Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

Vendors: progress
Products: moveit transfer
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (81.5%)

In the news8 stories

Week in review: MOVEit auth bypass flaws quitely fixed, open-source Rafel RAT targets Androids

Help Net SecurityJun 30, 00:00 UTC · Jun 30, 2024Malware CVE-2024-5805 CVE-2024-5806 CVE-2024-5276

Critical MOVEit vulnerability puts huge swaths of the Internet at severe risk

Ars Technica · SecurityJun 26, 23:31 UTC · Jun 26, 2024Vulnerability CVE-2024-5806

New MOVEit Transfer critical bug is actively exploited

Security AffairsJun 26, 19:54 UTC · Jun 26, 2024Vulnerability in the wildCVE-2024-5805 CVE-2024-5806

Progress Software elevates severity of new MOVEit bug to ‘critical’ as exploit attempts jump

The RecordJun 26, 18:57 UTC · Jun 26, 2024Ransomware CVE-2024-5806

Progress Discloses Two New Vulnerabilities in MOVEit Products

Infosecurity MagazineJun 26, 17:15 UTC · Jun 26, 2024Vulnerability in the wildCVE-2024-5806 CVE-2024-5805