CVE-2026-10697 is an improper authentication flaw (CWE-287) in Progress MOVEit Transfer, scored 7.5 high. It affects versions before 2025.1.5 and 2026.0.0 up to but not including 2026.0.3. Upgrade to 2025.1.5, 2026.0.3 or later. Progress lists the fix as improved authentication enforcement for a legacy integration endpoint.
What's affected
Per the CVE record, MOVEit Transfer before 2025.1.5, and the 2026 line from 2026.0.0 before 2026.0.3.
The Progress release notes for the 2026.0.3 service pack include the entry, tagged under MFA and security, with the text "Improved authentication enforcement for legacy integration endpoint." The release notes page was last updated on July 24, 2026. The record has very little detail beyond that, and Progress has not published exploitation specifics in the sources I reviewed.
How to check if you're exposed
Find the installed version in your MOVEit Transfer administration interface and compare it with the fixed releases. If you run the 2025.1 line, you need 2025.1.5 or later. If you run the 2026 line, you need 2026.0.3 or later.
Then list how the product is reachable. Check whether the web interface and any legacy integration endpoints are exposed to the internet, and which integrations your partners use. Review authentication logs for failed or unusual sign ins around integration endpoints, and for new accounts or changed permissions.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Upgrade MOVEit Transfer to 2025.1.5 or 2026.0.3, or any later release on your line.
- Read the Progress fixed issues page for your release and apply any other listed security entries in the same upgrade.
- Limit internet exposure of the product to the endpoints your partners actually need, and put the admin interface on a private network.
- Review authentication and file transfer logs for unexpected access, and rotate credentials for service accounts if you see anything odd.
- Retire legacy integration endpoints you no longer use.
Why it matters
Managed file transfer products hold sensitive files and sit at the edge of the network, so authentication flaws in them are high value. The record classes this as CWE-287, which covers cases where the product does not properly verify who is calling.
The record does not flag it as exploited in the wild, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. The vendor notes give few details, so rely on version checks and patching. Do not wait for exploit details before you plan the upgrade.
Quick check
Which versions are fixed?
2025.1.5 on the 2025.1 line and 2026.0.3 on the 2026 line, per the CVE record and the Progress release notes.
Does an upgrade need a maintenance window?
Plan one. Check the Progress upgrade guide for your edition and test with a staging copy before production.
Sources
Last reviewed: 19 October 2026.
