CVE-2024-0396 is a high severity (CVSS 7.1) input validation flaw in Progress MOVEit Transfer. An authenticated user can change a parameter in an HTTPS transaction and cause computational errors that may lead to denial of service. Upgrade to 2022.0.10, 2022.1.11, 2023.0.8 or 2023.1.3, or later.
What's affected
Per the record, MOVEit Transfer versions released before these builds, shown with their older numbering:
- 2022.0.10 (14.0.10)
- 2022.1.11 (14.1.11)
- 2023.0.8 (15.0.8)
- 2023.1.3 (15.1.3)
So each release line has its own fixed build. If you are on 2022.0.x, you need 2022.0.10 or later in that line. A later release line also contains the fix.
The weakness is CWE-20, improper input validation. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H: network reachable, low complexity, low privileges, no user interaction, with low integrity impact and high availability impact. The Progress community article referenced by the record is titled "MOVEit Transfer Service Pack January 2024". Its content did not load in readable form for us, so the version list above comes from the record, and you should confirm it against the Progress article.
The record is not on the CISA Known Exploited Vulnerabilities list, and we found no source that says it has been exploited.
How to check if you're exposed
Find the MOVEit Transfer version in your deployment using the product's own version information and compare it with the four builds above, matching your release line. The Progress service pack article is the place to confirm the exact build mapping.
Because exploitation needs a valid login, also review who holds accounts. Service accounts, partner accounts and old test users all count. The attacker model here is any authenticated user, so a large number of external accounts raises the exposure.
What to do now
- Identify your MOVEit Transfer release line and current build.
- Apply the January 2024 service pack or any later release for your line, following Progress's upgrade instructions.
- Disable or remove accounts that are no longer needed, and review accounts held by third parties.
- Watch service availability and error logs after patching and before, so an outage caused by malformed transactions is not mistaken for an infrastructure fault.
- Keep a standing inventory of file transfer software, so the next advisory takes minutes to triage. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can inventory the dependencies of software you build yourself.
Why it matters
This flaw is about availability. It needs a login, and the stated result is a possible denial of service, not data theft or code execution. For a managed file transfer service that partners rely on, an outage still has real cost.
The class of weakness is simple. The server accepted a parameter value it should have rejected and then did arithmetic or processing on it that failed. Validating input at the boundary, and handling failure without taking down the service, is the standard defence. Check the advisory for any details Progress adds beyond the record.
Quick check
Do I need an account to exploit CVE-2024-0396?
Yes. The record describes an authenticated user manipulating a parameter in an HTTPS transaction, and the vector requires low privileges.
Is CVE-2024-0396 exploited in the wild?
It is not in the CISA Known Exploited Vulnerabilities catalog, and the sources we could read do not report exploitation.
Sources
- Gold entry for CVE-2024-0396
- Progress article: MOVEit Transfer Service Pack January 2024 (page did not load readable text, so versions come from the record)
Last reviewed: 19 October 2026.
