CVE-2025-11235: MOVEit Transfer Auth Bypass Vulnerability

CVE-2025-11235 Overview

An Unverified Password Change vulnerability exists in Progress MOVEit Transfer on Windows, specifically within the REST API modules. This security flaw allows attackers to potentially manipulate password change functionality without proper verification, which could lead to account compromise or service disruption in affected MOVEit Transfer deployments.

Critical Impact

This vulnerability affects the password change mechanism in MOVEit Transfer's REST API, potentially allowing unauthorized password modifications that could disrupt service availability.

Affected Products

• Progress MOVEit Transfer versions 2023.1.0 to 2023.1.2 (fixed in 2023.1.3)
• Progress MOVEit Transfer versions 2023.0.0 to 2023.0.7 (fixed in 2023.0.8)
• Progress MOVEit Transfer versions 2022.1.0 to 2022.1.10 (fixed in 2022.1.11)
• Progress MOVEit Transfer versions 2022.0.0 to 2022.0.9 (fixed in 2022.0.10)

Discovery Timeline

• January 7, 2026 - CVE-2025-11235 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-11235

Vulnerability Analysis

This vulnerability is classified under CWE-620 (Unverified Password Change), which occurs when a web application allows users to change their passwords without requiring the current password or other verification mechanisms. In the context of MOVEit Transfer, the REST API modules fail to properly validate password change requests, creating a potential avenue for unauthorized access or account manipulation.

The network-based attack vector requires no authentication and can be exploited without user interaction, though the complexity of successful exploitation is high. The primary impact is to system availability rather than confidentiality or integrity.

Root Cause

The root cause of this vulnerability lies in insufficient verification controls within the password change functionality of the REST API modules. The application does not adequately verify the identity of the requester before processing password change requests, violating secure authentication design principles. This lack of proper identity verification in the password modification workflow creates an exploitable condition.

Attack Vector

The vulnerability is exploitable over the network through the MOVEit Transfer REST API endpoints. An attacker would need to craft specially formed requests to the password change API endpoint. While the attack requires no prior authentication, the high attack complexity suggests that specific conditions or timing may need to be met for successful exploitation. The impact is primarily denial of service, as successful exploitation could lock users out of their accounts or disrupt password-related functionality.

The vulnerability manifests in the REST API's password change handling mechanism. Affected deployments should consult the Progress Release Notes for version 2023.1.3 for detailed technical information about the fix.

Detection Methods for CVE-2025-11235

Indicators of Compromise

• Unusual volume of password change requests targeting the REST API endpoints
• Failed or anomalous authentication attempts following password change API calls
• Log entries showing password modifications without corresponding user-initiated sessions
• Multiple password change requests from unexpected IP addresses or geographic locations

Detection Strategies

• Monitor REST API logs for abnormal password change request patterns
• Implement rate limiting detection on authentication-related API endpoints
• Configure alerts for password change operations that lack normal user session context
• Review audit logs for password changes that don't correlate with user activity patterns

Monitoring Recommendations

• Enable detailed logging for all REST API authentication endpoints
• Deploy network intrusion detection signatures for anomalous MOVEit Transfer API traffic
• Implement user behavior analytics to detect unusual password change activities
• Configure SIEM rules to correlate password change events with user session data

How to Mitigate CVE-2025-11235

Immediate Actions Required

• Upgrade MOVEit Transfer to the latest patched version immediately
• Review recent password change logs for any suspicious activity
• Temporarily restrict access to REST API endpoints from untrusted networks if patching is delayed
• Enable enhanced logging on authentication-related API endpoints

Patch Information

Progress has released security patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• MOVEit Transfer 2023.1.3 or later (for 2023.1.x branch)
• MOVEit Transfer 2023.0.8 or later (for 2023.0.x branch)
• MOVEit Transfer 2022.1.11 or later (for 2022.1.x branch)
• MOVEit Transfer 2022.0.10 or later (for 2022.0.x branch)

Detailed patch information is available in the Progress Release Notes for version 2023.1.3.

Workarounds

• Implement network-level access controls to limit REST API exposure to trusted networks only
• Deploy a web application firewall (WAF) with rules to monitor and filter suspicious password change requests
• Enable multi-factor authentication where supported to add additional verification layers
• Consider temporarily disabling REST API password change functionality if not operationally required

# Example: Network-level restriction using Windows Firewall
# Restrict REST API port access to trusted IP ranges only
netsh advfirewall firewall add rule name="MOVEit REST API Restriction" dir=in action=allow protocol=TCP localport=443 remoteip=10.0.0.0/8,192.168.0.0/16