Progress Patches High-Severity Vulnerability in MOVEit Transfer AS2 Module (CVE-2025-10932)

Progress Software Corporation has issued a security advisory warning of a high-severity vulnerability in MOVEit Transfer’s AS2 module, tracked as CVE-2025-10932 and rated CVSS 8.2. The flaw, described as an Uncontrolled Resource Consumption issue, affects MOVEit Transfer releases from 2025.0.0 up to before 2025.0.3, 2024.1.0 up to before 2024.1.7, and 2023.1.0 up to before 2023.1.16, with Progress MOVEit Cloud already patched.

The vulnerability could allow a malicious actor to exhaust server resources via crafted AS2 requests, potentially disrupting file transfers or degrading performance, and is mitigated by hotfixes and upgraded versions that add IP address whitelisting to restrict access to the AS2 module. On-premises deployments, however, remain at risk until admins apply fixes, and Progress also recommends temporarily removing AS2 endpoints for non-AS2 users and configuring IP allowlists for trusted partners.

According to Progress, the MOVEit ecosystem remains a high-value target due to its role in sensitive data movement, although CVE-2025-10932 is not currently known to be exploited.