Progress Releases Patch for MOVEit Transfer Resource Consumption Flaw

Progress Software has issued security patches for MOVEit Transfer to fix a high-severity vulnerability in the AS2 module that was discovered on 29 October 2025. The flaw, tracked as CVE-2025-10932 and rated 8.2 on the CVSS scale, enables an attacker to cause uncontrolled resource consumption and potential service degradation or unavailability without authentication.

Progress has released patched versions that implement IP address whitelisting to protect the AS2 module from unauthorised access, and cloud-hosted MOVEit Cloud customers have already been upgraded. The vulnerability affects MOVEit Transfer versions ranging from 2025.0.0 through 2025.0.2, 2024.1.0 through 2024.1.6, and 2023.1.0 through 2023.1.15; organisations should prioritise updating.

Available fixed versions include MOVEit Transfer 2025.0.3, 2024.1.7, and 2023.1.16 for the respective version branches, with an interim measure of temporarily disabling the AS2 module or whitelisting trusted AS2 trading partners if immediate patching isn’t possible.