MOVEit Transfer SQL Injection Leading to Remote Code Execution
A SQL injection vulnerability in Progress Software's MOVEit Transfer web application allowed unauthenticated attackers to access the underlying database and, in many cases, deploy a web shell for remote code execution. Exploited at mass scale by the Clop ransomware group starting May 2023.
- Vendor
- Progress Software
- Product
- MOVEit Transfer
- CVSS
- 9.8
- EPSS (exploit probability)
- 99.9%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2023-34362 being exploited?
Yes. CISA added CVE-2023-34362 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 99.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2023-34362 timeline
- Added to CISA KEVsame day as NVD
- Published to NVD
- First 0dayNews coverage+1134d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2023-34362 is a SQL injection vulnerability in Progress Software’s MOVEit Transfer managed file-transfer product. Unauthenticated attackers could send crafted HTTP requests to the application’s web interface, gain access to the underlying database, and in many observed cases drop a web shell to achieve remote code execution.
The flaw was added to the CISA Known Exploited Vulnerabilities (KEV) catalog after the Clop ransomware group began exploiting it at scale beginning around May 27, 2023 — before a public patch existed, making it a true zero-day at the time of first exploitation. Progress Software disclosed and patched the issue on June 2, 2023.
Why it mattered
MOVEit Transfer is widely used by enterprises and government agencies to move sensitive files, including PII and financial records. The mass-exploitation campaign tied to this CVE became one of the largest single-vulnerability data-theft events of 2023, affecting hundreds of organizations and tens of millions of individuals whose data was exfiltrated before extortion demands were issued.
See CISA’s KEV catalog and Progress Software’s own advisory for remediation guidance and indicators of compromise.
Other Progress Software CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-8037 Progress Kemp LoadMaster pre-auth OS command injection RCEwrite-up | [ CRITICAL ] | 9.6 | 99.8% | |
| CVE-2026-2701 Progress ShareFile Storage Zone Controller authenticated file-upload RCEwrite-up | [ CRITICAL ] | 9.1 | 54.5% | — |
| CVE-2026-2699 Progress ShareFile Storage Zone Controller pre-auth access via Execution After Redirectwrite-up | [ CRITICAL ] | 9.8 | 58.4% | — |
- Kiteworks Flags Potential Zero-Day, Urges Server Shutdown
- Clop Claims 89GB Shell Theft; Investigation Open
- Clop Hits Windchill and FlexPLM in Data-Theft Push
- Clop Data Theft Campaign Hits PTC Windchill, FlexPLM
- CVE-2023-22515: Three Years of Confluence Exploitation
- Progress tells ShareFile on-prem users to shut down servers