MOVEit Transfer and the Breach That Defined 2023

July 2026, and the EPSS model still puts CVE-2023-34362 at 0.99934. That’s not a data artifact — it’s the model picking up on continued scanning activity, available proof-of-concept tooling, and a residual population of internet-facing MOVEit Transfer instances that have not received the patch in more than three years. A vulnerability this well-documented, this well-armed, and this widely exploited still has a live target population. That’s the part worth pausing on.

What happened

MOVEit Transfer is a managed file transfer product used by enterprises and government agencies to move large volumes of sensitive data: payroll records, healthcare files, financial documents, the kind of material that accumulates value precisely because it transits systems that nobody thinks of as “the database.” The Cl0p ransomware group understood this, and in late May 2023 they began exploiting a SQL injection flaw in the product’s web-facing HTTP interface before Progress Software had issued a patch or publicly acknowledged the vulnerability.

The exploit was a zero-day at first use. Progress Software disclosed the vulnerability and issued patches on June 2, 2023. By then Cl0p had already been inside dozens of organizations — later reporting confirmed hundreds — and had exfiltrated data from each of them. The group issued extortion demands and published stolen data when organizations declined to pay, eventually claiming a victim count touching tens of millions of individuals whose records had transited MOVEit during the exposure window.

CISA added CVE-2023-34362 to the Known Exploited Vulnerabilities catalog shortly after the public advisory. The NVD entry carries a CVSS 3.1 score of 9.8, reflecting the unauthenticated reach and what successful exploitation unlocked.

The vulnerability class

CVE-2023-34362 is a SQL injection flaw in the MOVEit Transfer web application. SQL injection as a class is a decades-old problem: user-controlled input reaches a database query without adequate sanitization, and an attacker can use that path to extract data from the underlying database or, in some configurations, execute commands on the host system. In the MOVEit case, the distance from the injection point to database access to persistent code execution was short enough that Cl0p automated it and ran it at scale across hundreds of targets in a matter of days.

Managed file transfer products are a high-yield target for this class of attack. They’re designed to hold sensitive data in transit. They’re reachable from the public internet by design. And they tend to aggregate files across business units or client relationships, which multiplies the per-compromise value for anyone running a data-theft operation rather than a straight encryption-for-ransom play.

Three years of progress, and what hasn’t moved

Progress Software patched CVE-2023-34362 in June 2023, followed with additional fixes for related issues discovered in the disclosure aftermath, and has since made visible investments in its security posture — expanded penetration testing commitments, bug-bounty program growth, and a more formal PSIRT process. That’s real, and it belongs in the record. The product in 2026 is not the same product Cl0p exploited.

What hasn’t changed is the tail of unpatched instances. MOVEit Transfer has a long-term enterprise customer base that includes organizations with slow patch cycles, air-gapped deployments, and systems inherited through acquisitions where ownership of the update cadence is unclear. The 0.99934 EPSS score reflects that residual exposure: active scanning, existing exploit tooling, and confirmed exploitation observations all feed the model, and CVE-2023-34362 checks every box.

The broader lesson — managed file transfer as a category is high-value for attackers who think in terms of data yield per intrusion — didn’t dissipate after the June 2023 patches. Progress Software’s own WS_FTP Server and ShareFile products each had their own vulnerability cycles afterward, for the same reason: the category attracts attention.

What to do now

If you’re still running MOVEit Transfer, the checklist is short:

• Verify you’re patched. Progress Software’s security portal lists affected and fixed builds, including the June 2023 release and every subsequent security update.
• Check for web shell persistence. One of the consistent findings across the Cl0p campaign was the deployment of a web shell the group named LEMURLOOT, documented in CISA’s advisory AA23-158A. Patching the SQL injection flaw does not remove web shells that were deployed before the patch was applied. If your organization was running an unpatched version during the May–June 2023 window, the indicators of compromise in AA23-158A are still the right starting point for a retroactive look.
• Audit access logs from that period. CISA’s advisory includes forensic triage guidance that remains valid for retrospective review.

---

Cl0p didn’t discover something novel in 2023. SQL injection has been on the OWASP list since 2003. What they found was a target population large enough to make automation worthwhile, and a file-transfer category concentrated enough that one CVE could yield a record haul. The same conditions that made that possible haven’t gone away — they’ve just shifted to whichever products are next in line.