Is CVE-2023-35708 actively exploited?

Yes. CVE-2023-35708 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-35708 be exploited remotely?

The attack vector of CVE-2023-35708 has not been classified yet.

What is the CVSS score of CVE-2023-35708?

CVE-2023-35708 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-35708

UNKNOWNCISA KEVIN THE WILD

CVE-2023-35708

Published: April 11, 2026

Official Description

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).

NVD Source

Risk Analysis

This SQL injection vulnerability in Progress MOVEit Transfer allows unauthenticated attackers to gain unauthorized access to the database. The confirmed exploitation in the wild means this is a critical issue, risking data modification and disclosure.

This vulnerability is actively being exploited in the wild. An unauthenticated attacker can remotely gain unauthorized database access by submitting a crafted payload to a MOVEit Transfer application endpoint.

Recommended Action

Upgrade Progress MOVEit Transfer to versions 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), or 2023.0.3 (15.0.3) or later. Ensure all DLL drop-ins are also updated to the fixed versions.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-35708 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-35708 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.