What We Do
How We Do
Get Started
Security advisories

MOVEit Transfer Vulnerability - CVE-2023-35036

June 13, 2023 | 1 MIN READ

Speak With A Security Expert Now



On June 12th, Progress Software disclosed a new vulnerability impacting the MOVEit Transfer file transfer application. The vulnerability is distinct from the recently patched MOVEit Transfer vulnerability CVE-2023-34362. The latest release is a SQL injection vulnerability tracked as CVE-2023-35036; exploitation would allow an unauthenticated remote attacker to access the MOVEit Transfer's database, enabling data modification or theft. There is no indication of real-world attacks at this time, but due to the high value of the vulnerability eSentire assesses it is probable exploitation will occur in the near future.

Progress Software has released new security patches to address this vulnerability and organizations are strongly recommended to apply the patches as soon as possible.

What we’re doing about it

What you should do about it

Additional information

CVE-2023-35036 impacts MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2). While CVE-2023-35036 has not been identified in real-world attacks at this time, exploitation in the future is expected. As such, organizations are strongly recommended to apply the latest round of security patches. It should be noted that organizations that have applied security patches for CVE-2023-34362 are still vulnerable to CVE-2023-35036 and are required to install the new patches.

This week, new updates related to the previous MOVEit Transfer vulnerability CVE-2023-34362 were disclosed. The company Horizon3 has released technical details and Proof-of-Concept (PoC) exploit code for the vulnerability. This release significantly increases the likelihood of widespread exploitation of CVE-2023-34362 by threat actors. To date, only the CLOP (Lace Tempest) threat actor group has been identified exploiting the vulnerability. Any organization that has not yet applied security patches for CVE-2023-34362 needs to treat all potentially impacted devices as compromised until validated secure.


[1] https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
[2] https://www.cve.org/CVERecord?id=CVE-2023-35036
[3] https://www.esentire.com/security-advisories/critical-vulnerability-in-moveit-transfer
[4] https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/

View Most Recent Advisories