VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 6, 2026· Updated Jan 7, 2026

MOVEit Transfer REST API does not require current password in order to initiate the password change process

CVE-2025-11235

Description

Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

Affected products

2
  • Ipswitch, Inc./Moveit Transfer 2017llm-fuzzy
    Range: >=2022.0.0 <2022.0.10, >=2022.1.0 <2022.1.11, >=2023.0.0 <2023.0.8, >=2023.1.0 <2023.1.3
  • Progress/MOVEit Transferv5
    Range: 2023.1.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.