CVE-2026-10697 HIGH

CVE-2026-10697: MFA Bypass in MOVEit Transfer

Vendor Progress
Product MOVEit Transfer
Weakness CWE-287 · Improper authentication
Published July 23, 2026
Last update July 24, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Key dates

02Disclosure timeline

July 23, 2026 CVE published
July 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-36832 Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass CVE-2026-0633 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value CVE-2024-11293 Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider