CVE-2023-36933

What it actually does

This vulnerability affects Progress MOVEit Transfer versions before 2021.0.9 / 13.0.9, 2021.1.7 / 13.1.7, 2022.0.7 / 14.0.7, 2022.1.8 / 14.1.8, and 2023.0.4 / 15.0.4. A remote unauthenticated attacker can invoke an application method that triggers an unhandled exception, causing the MOVEit Transfer application process to terminate unexpectedly. The impact is denial of service: confidentiality and integrity are not directly affected by the flaw, but availability of managed file transfer services can be lost until the application is restarted and the vulnerable path is no longer reachable.

Why it matters to the business

Successful exploitation can interrupt file-transfer operations that business processes, partners, customers, and automated workflows depend on. Because MOVEit Transfer is commonly used for sensitive and time-critical data exchange, outages can delay payments, reporting, supply-chain communications, regulatory submissions, customer deliverables, and incident response operations. The CVSS availability impact is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation activity even though this CVE is not listed in CISA KEV and is not specifically marked as ransomware-used.

How an attack unfolds

An attacker identifies an internet-accessible MOVEit Transfer instance running a vulnerable version, then sends a specially crafted request that reaches the vulnerable workflow and invokes the method that mishandles an exception. Because the exception is not safely handled, the MOVEit Transfer application can terminate instead of returning a controlled error. Repeated requests can keep the service unavailable, creating a sustained denial-of-service condition. Exploitation does not require authentication, user interaction, or prior access, so exposed systems are the highest-risk targets.

How to fix it

Upgrade MOVEit Transfer to a fixed version or later: 2021.0.9 / 13.0.9, 2021.1.7 / 13.1.7, 2022.0.7 / 14.0.7, 2022.1.8 / 14.1.8, or 2023.0.4 / 15.0.4. If immediate upgrade is not possible, reduce exposure by restricting access to trusted networks, enforcing VPN or private connectivity for administrative and file-transfer interfaces, applying web application firewall or reverse-proxy controls where feasible, and rate-limiting suspicious repeated requests. Ensure service monitoring automatically alerts on MOVEit process termination and that restart procedures do not mask repeated exploitation attempts. Because MOVEit Transfer has been a high-value target historically, treat patching as urgent even though this specific CVE is not in KEV.

How to confirm the fix worked

Confirm the installed MOVEit Transfer version is at or above the fixed release for the deployed branch. Validate both product UI-reported version and file/package version where possible. After patching, perform a controlled service health check and confirm normal web, API, SFTP/HTTPS, and scheduled transfer functionality. Review firewall, proxy, and exposure management data to ensure MOVEit interfaces are not broadly reachable unless business-required. Verify that no repeated application crashes, service restarts, or unhandled exception events continue after remediation.

Typical attack path

1. Discover MOVEit Transfer instances exposed to the internet or reachable from a network segment the attacker can access.
2. Fingerprint the application version or infer vulnerability based on response behavior, banners, login pages, headers, or patch status.
3. Send a crafted request that invokes the vulnerable method and triggers the unhandled exception workflow.
4. Observe that the MOVEit Transfer application becomes unavailable, returns connection failures, or restarts unexpectedly.
5. Repeat the request to prolong the outage or time it to disrupt scheduled file-transfer jobs and partner integrations.

How to detect it

To determine whether this vulnerability was already exploited, review MOVEit Transfer application logs, web server logs, reverse proxy logs, WAF logs, Windows Event Logs, and service monitoring telemetry for unexplained application terminations or crash loops correlated with inbound requests. Focus on spikes in HTTP 500-series responses, abrupt connection resets, repeated requests immediately preceding MOVEit service stops, and recurring access from the same source shortly before outages. In Windows Event Viewer, check Application and System logs for application error events, .NET runtime exceptions, Windows Error Reporting entries, and service control events indicating that MOVEit-related services terminated unexpectedly or restarted. Compare timestamps of crashes with perimeter logs to identify source IPs, URLs, methods, user agents, and request patterns. Because this is a denial-of-service issue rather than a code execution or data theft flaw, durable host artifacts may be limited; absence of files or persistence artifacts does not rule out exploitation.

• MOVEit Transfer application terminated unexpectedly
• Unhandled exception
• Application Error
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• The MOVEit Transfer service terminated unexpectedly
• MOVEitDMZ
• w3wp.exe
• HTTP 500
• HTTP 503

What your security team should do

• Prioritize upgrading all MOVEit Transfer deployments to a fixed version or later, especially internet-facing systems.
• Inventory all exposed MOVEit Transfer interfaces, including web, API, HTTPS file-transfer, and administrative access paths.
• Temporarily restrict access to known business partner IP ranges or private connectivity until upgrades are complete.
• Enable or tune monitoring for MOVEit application crashes, Windows service restarts, HTTP 5xx spikes, and repeated requests from the same source.
• Review historical logs for unexplained outages or crash loops around MOVEit services since the vulnerability publication date.
• Coordinate with business owners to identify critical scheduled transfers and define manual fallback procedures during remediation windows.
• Maintain heightened monitoring for MOVEit generally, as the product family has been heavily targeted by threat actors even when a given CVE is not in CISA KEV.