CVE-2025-11235
Low
Description
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
SeverityLow
CVSS3.7
Exploit probability—
Product
Progress Moveit Transfer
PublishedJan 7, 2026
First seenJan 7, 2026
Weakness typeCWE-620CWE-620
How to fix
Update
- progress moveit_transfer2022.0.10, 2022.1.11, 2023.0.8, 2023.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress moveit_transfer | 2022.0.0 ≤ v < 2022.0.10, 2022.1.0 ≤ v < 2022.1.11, 2023.0.0 ≤ v < 2023.0.8, 2023.1.0 ≤ v < 2023.1.3 | 2022.0.10, 2022.1.11, 2023.0.8, 2023.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.