Full Report
Progress security advisory (AV26-1058)
Analysis Summary
# Vulnerability: Progress MOVEit Transfer Security Advisory (AV26-1058)
## CVE Details
- CVE ID: Not provided in source. The advisory states Progress is affected by "vulnerabilities" but does not list identifiers.
- CVSS Score: Not provided in source
- CWE: Not provided in source
## Affected Systems
- Products: MOVEit Transfer
- Versions:
- Prior to 2025.1.6
- Prior to 2026.0.4
- Configurations: Not specified in source
## Vulnerability Description
The Canadian Centre for Cyber Security (Cyber Centre) reports that, as of October 14, 2026, Progress MOVEit Transfer is affected by vulnerabilities in the listed versions. The advisory does not describe the flaw types, root causes, or affected components. For technical details, consult the vendor bulletin linked below.
## Exploitation
- Status: Not specified in source
- Complexity: Not specified in source
- Attack Vector: Not specified in source
## Impact
- Confidentiality: Not specified in source
- Integrity: Not specified in source
- Availability: Not specified in source
## Remediation
### Patches
- Upgrade MOVEit Transfer to version 2025.1.6 or later on the 2025.1 branch.
- Upgrade MOVEit Transfer to version 2026.0.4 or later on the 2026.0 branch.
- Consult the vendor's September 2026 critical security bulletin for the exact fixed builds and upgrade instructions.
### Workarounds
- None listed in source. Check the vendor bulletin for interim mitigations if patching cannot be done immediately.
## Detection
- Indicators of compromise: None provided in source.
- Detection methods and tools:
- Confirm the installed MOVEit Transfer version against the vulnerable ranges above.
- Review web server, authentication, and file transfer logs for unusual access patterns, unexpected administrative activity, or anomalous file transfers, especially for the period before patching.
- Check the vendor bulletin for any published IOCs or detection guidance.
## References
- Cyber Centre advisory (AV26-1058): hxxps[:]//www[.]cyber[.]gc[.]ca/fr/alertes-avis/bulletin-securite-progress-av26-1058
- MOVEit Transfer Critical Security Bulletin, September 2026: hxxps[:]//community[.]progress[.]com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026
- Progress Trust Center: hxxps[:]//www[.]progress[.]com/trust-center
**Analyst note:** The source is a short notice that identifies affected versions and points to the vendor bulletin, but it does not provide CVE IDs, CVSS scores, exploitation status, or IOCs. Verify these details in the vendor bulletin before prioritizing or completing a risk assessment. Because MOVEit Transfer is a file transfer server that is often internet-facing, treat patching as a priority.