MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806)

What to do

1. Upgrade MOVEit Transfer to 2023.0.11, 2023.1.6, 2024.0.2 or any later supported release
2. Restrict SFTP (port 22) exposure to known partner IP ranges where possible
3. Block inbound RDP to MOVEit servers and limit outbound connections to known, trusted endpoints, as Progress advised
4. Block outbound SMB from the MOVEit host to stop forced-authentication hash leaks
5. Raise SFTP logging and review historical logs for empty-fingerprint public key authentication

How to check if you are affected or compromised

• Search SFTP logs for 'Attempted to authenticate empty public key fingerprint'
• Look for 'Client key validation successful but password is also required' followed by a denied authentication on the same connection ID
• Check web and system logs for SSH or PPK public key material submitted by unauthenticated clients
• Alert on unexpected outbound SMB or DNS lookups from the MOVEit server

What happened#

On June 25, 2024, Progress Software disclosed CVE-2024-5806, an improper authentication flaw in the SFTP module of MOVEit Transfer, its managed file transfer server. Progress's CVE record says the bug "can lead to Authentication Bypass" and scores it CVSS 3.1 9.1; NVD rates it 9.8. MOVEit is the same product line that the Cl0p group mass-exploited in 2023, so any new pre-authentication bug in it draws immediate attention.

The same day, watchTowr Labs published a full root-cause analysis. During SSH public key authentication, MOVEit's SFTP server passed client-supplied key data to the IPWorks SSH library, which could treat it as a file path. When a key was loaded from a file, the library handed MOVEit an empty fingerprint. An error branch then returned "denied" without setting a status code, which the caller read as "key valid, password still required". MOVEit cached the empty fingerprint as authenticated, and on the next step the empty key matched the cache. The result: login as any valid SFTP user without their credentials.

Who is affected#

Self-hosted MOVEit Transfer from 2023.0.0 before 2023.0.11, 2023.1.0 before 2023.1.6, and 2024.0.0 before 2024.0.2. Per BleepingComputer's reporting, MOVEit Cloud was patched by Progress, Censys counted about 2,700 internet-exposed MOVEit Transfer instances at the time, and a related bug, CVE-2024-5805, affected MOVEit Gateway 2024.0.0. Progress also warned of a separate flaw in a third-party component that raised the risk of this bug.

Do you really need to act?#

If you run an unpatched MOVEit Transfer, yes. The preconditions are real but not demanding. watchTowr notes the attacker needs a valid username (and that the flaw itself enables username enumeration), plus a public key at a path the server can read. Their demonstrated route placed a key into a log file via an unauthenticated web request. Pointing the path at an attacker's SMB share instead leaks the service account's Net-NTLMv2 hash. watchTowr openly questioned Progress's "limited scenarios" framing.

BleepingComputer reported that the Shadowserver Foundation saw exploitation attempts less than a day after disclosure, and proof-of-concept code was public. As of October 21, 2026, CVE-2024-5806 is not listed in the CISA KEV catalog, and we found no confirmed mass-compromise campaign comparable to 2023. Given what a successful login exposes (partner files, often regulated data), that absence is not a reason to wait.

What to do now#

1. Upgrade to 2023.0.11, 2023.1.6, 2024.0.2 or any later supported release. Check the installed version in the MOVEit Transfer admin interface.
2. Limit SFTP exposure to known partner IP ranges if your business allows it.
3. Apply Progress's interim guidance: block inbound RDP to MOVEit servers and restrict outbound connections to known, trusted endpoints.
4. Block outbound SMB (TCP 445) from the MOVEit host to defeat the forced-authentication variant.
5. Make sure SFTP logging is verbose enough to capture authentication detail; watchTowr notes some indicators appear only in non-default logging.

How to tell if you were hit#

watchTowr published concrete log indicators. The strongest is Client key validation successful but password is also required appearing with a denied authentication on the same connection ID. Also search for Attempted to authenticate empty public key fingerprint, validation messages with a blank fingerprint (two spaces where the hash should be), and IPWorks errors saying the certificate store could not be opened. Look for SSH or PPK key material in web logs from unauthenticated requests, and unexpected outbound SMB or DNS traffic from the server. If you find hits, review which user accounts logged in over SFTP and what files they read or changed.

Timeline#

• Jun 25, 2024 — Progress publishes CVE-2024-5806 and fixed builds; watchTowr publishes technical analysis.
• Jun 26, 2024 — Within a day of disclosure, Shadowserver reports exploitation attempts, per BleepingComputer.
• Oct 21, 2026 — Not in CISA KEV as of this writing.

Vulnerability records

• CVE-2024-5806 · Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE.org — CVE-2024-5806 record (Progress Software, CNA) cve.org
2. NVD — CVE-2024-5806 nvd.nist.gov
3. watchTowr Labs — Auth. Bypass In (Un)Limited Scenarios: Progress MOVEit Transfer (CVE-2024-5806) labs.watchtowr.com
4. CISA — Known Exploited Vulnerabilities Catalog cisa.gov

Coverage and analysis

1. BleepingComputer — Hackers target new MOVEit Transfer critical auth bypass bug bleepingcomputer.com