CVE-2020-8612: Progess MOVEit Transfer

Critical severity, CVSS 9.0. EPSS: 1.7% chance of exploitation in the next 30 days.

In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.

Affected products

• Progess MOVEit Transfer: from 2019.1, before 2019.1.4 (fixed in 2019.1.4)
• Progress MOVEit Transfer: from 2019.2, before 2019.2.1 (fixed in 2019.2.1)

Published 2020-02-14. Last modified 2026-06-17.