VulnRadar

Data against noise.

Built with NaN
Page generated: 06 Nov 2026, 03:49 UTC
← Dashboard

CVE-2023-34362

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to…

Read full description
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.4/10
General review priority; not probability

Evidence confidence: Campaign documented

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 99.93%: +0.50
  • Documented campaign: +0.40

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 27 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

The Hacker News
Press · 27 Jun 2025, 07:00 · MOVEit Transfer Faces Increased Threats as Scanning Surges and CVE Flaws Are Targeted - The Hacker News
InfoStealers
Press · 11 Nov 2024, 08:00 · Vulnerability Breach: Massive Corporate Data Leaks Exposed - InfoStealers
SECURITY.COM
Press · 06 Oct 2024, 10:10 · MOVEit Vulnerabilities: What You Need to Know - SECURITY.COM
The Hacker News
Press · 26 Jun 2024, 07:00 · Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability - Patch ASAP! - The Hacker News
SentinelOne
Press · 10 May 2024, 07:00 · CVE-2023-34362: Unmasking MOVEit Transfer Vulnerability - SentinelOne
See all 27 source documents
Resecurity
Press · 23 Aug 2023, 07:00 · Cl0p Ups the Ante with Massive MOVEit Transfer Supply-Chain Exploit - Resecurity
Arctic Wolf
Press · 21 Jul 2023, 07:00 · Rise of CI0p Ransomware - Arctic Wolf
Bitsight
Press · 20 Jul 2023, 07:00 · New research reveals rapid remediation of MOVEit Transfer vulnerabilities - Bitsight
The Hacker News
Press · 07 Jul 2023, 07:00 · Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software - The Hacker News
Cisco Talos Blog
Press · 16 Jun 2023, 07:00 · Active exploitation of the MOVEit Transfer vulnerability — CVE-2023-34362 — by Clop ransomware group - Cisco Talos Blog
Rapid7
Press · 14 Jun 2023, 07:00 · CVE-2023-34362: MOVEit Vulnerability Timeline of Events - Rapid7
The Hacker News
Press · 10 Jun 2023, 07:00 · New Critical MOVEit Transfer SQL Injection Vulnerabilities Discovered - Patch Now! - The Hacker News
Kroll
Press · 08 Jun 2023, 07:00 · Clop Ransomware Likely Sitting on MOVEit Transfer Vulnerability (CVE-2023-34362) Since 2021 - Kroll
Industrial Cyber
Press · 08 Jun 2023, 07:00 · CISA, FBI warn organizations that CL0P ransomware group exploits MOVEit Transfer vulnerability - Industrial Cyber
Akamai
Press · 08 Jun 2023, 07:00 · MOVEit SQLi Zero-Day (CVE-2023-34362) Exploited by CL0P Ransomware Group - Akamai
Qualys
Press · 07 Jun 2023, 07:00 · Progress MOVEit Transfer Vulnerability Being Actively Exploited - Qualys
Kroll
Press · 07 Jun 2023, 07:00 · Responding to the Critical MOVEit Transfer Vulnerability (CVE-2023-34362) - Kroll
The Hacker News
Press · 05 Jun 2023, 07:00 · Microsoft: Lace Tempest Hackers Behind Active Exploitation of MOVEit Transfer App - The Hacker News
The Record from Recorded Future News
Press · 05 Jun 2023, 07:00 · Clop ransomware group behind MOVEit file transfer hacks: Microsoft - The Record from Recorded Future News
Sophos
Press · 05 Jun 2023, 07:00 · Update 6: Information on MOVEit Vulnerabilities CVE-2023-34362, CVE-2023-35036, CVE-2023-35708, and CVE-2023-36934 - Sophos
wiz.io
Press · 04 Jun 2023, 07:00 · CVE-2023-34362 RCE vulnerability in MOVEit Transfer exploited in the wild: everything you need to know - wiz.io
Google Cloud
Press · 02 Jun 2023, 07:00 · Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft | Mandiant - Google Cloud
The Hacker News
Press · 02 Jun 2023, 07:00 · MOVEit Transfer Under Attack: Zero-Day Vulnerability Actively Being Exploited - The Hacker News
Rapid7
Press · 01 Jun 2023, 07:00 · Observed Exploitation of MOVEit Transfer Vulnerability CVE-2023-34362 - Rapid7
GreyNoise
Press · 01 Jun 2023, 07:00 · Progress’ MOVEit Transfer Critical Vulnerability: CVE-2023-34362 - GreyNoise
Huntress
Press · 01 Jun 2023, 07:00 · MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response - Huntress
BleepingComputer
Press · 01 Jun 2023, 07:00 · New MOVEit Transfer zero-day mass-exploited in data theft attacks - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.4 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
Malwareman007/CVE-2023-34362102Python09 Jul 2023, 18:48
errorfiathck/MOVEit-Exploit20Python31 Aug 2023, 13:28
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Campaign documented
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 99.9%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation; Trusted documented campaign

Score evaluated: 2026-11-05 13:58:55.035007+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Primary reports used by this score

  • Mandiant

    Mandiant incident response documented exploitation, web shells and data theft in the MOVEit campaign.

    Scope: Direct incident-response engagements in a historical campaign; no claim about current activity or global victim totals.

    Attack observation: 2023-05-27; source reviewed 2026-11-02.

    Date basis: The report explicitly identifies 27 May 2023 as its earliest observed exploitation date.

Source event timeline
First press mention
01 Jun 2023, 07:00
Published
02 Jun 2023, 00:00
Added to the CISA KEV catalog
02 Jun 2023, 00:00
Latest press mention
27 Jun 2025, 07:00
Score calculated
05 Nov 2026, 13:58
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar