Progress MOVEit Transfer patches multiple flaws
Progress patched several MOVEit Transfer vulnerabilities allowing privilege escalation, data exposure, and XSS in versions before 2026.0.2.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR issued an advisory for multiple vulnerabilities discovered in Progress MOVEit Transfer, a widely used managed file transfer product. The flaws affect MOVEit Transfer 2026.x releases prior to version 2026.0.2 and could allow an attacker to escalate privileges, compromise data confidentiality, and perform indirect remote code injection via cross-site scripting (XSS).
Three CVEs are referenced (CVE-2026-10698, CVE-2026-10699, CVE-2026-11903). No evidence of active exploitation is mentioned in the advisory. Progress has released patched version 2026.0.2 and affected organizations are advised to consult the vendor's security bulletin and apply the fix.
Mentioned in this report
Detection guidance
IIS Worker Process Spawning Command Shell (Possible MOVEit Transfer Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe (IIS application pool worker, e.g. hosting MOVEit Transfer) spawning a command interpreter, consistent with post-exploitation after a privilege-escalation or RCE flaw in a web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Command Shell
id: 606aa153-d54f-5e30-bd69-de8e089a758f
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe,
cscript.exe or wscript.exe, a pattern consistent with exploitation of a vulnerable
web application such as MOVEit Transfer leading to privilege escalation or remote
code execution.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
filter:
CommandLine|contains:
- C:\Windows\System32\inetsrv\
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks executed through
IIS application pool identity
- Custom application health-check or diagnostic scripts invoked by the web application
level: high
tags:
- attack.t1068
- attack.privilege-escalation
Web Application Worker Process Writing Script or Web Shell Files
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects w3wp.exe writing script files (.aspx, .asp, .js, .jsp) to the web application directory, indicative of a web shell drop following exploitation of a vulnerability such as those patched in MOVEit Transfer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Writing Script Files to Web Root
id: dd72f1ac-5bd3-53a3-a16e-826eb29faab6
status: experimental
description: Detects the IIS worker process (w3wp.exe) creating executable script
files (.aspx, .asp, .js, .jsp) within web application directories, which can indicate
a web shell dropped after exploitation of a managed file transfer or web application
vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith:
- .aspx
- .asp
- .js
- .jsp
filter:
TargetFilename|contains:
- \App_Data\
- \bin\
condition: selection and not filter
falsepositives:
- Application deployment or update processes that legitimately publish new script
files under the web application context
- Content management or file transfer application functionality that writes user-uploaded
scripts to non-executable storage paths
level: medium
tags:
- attack.t1068
- attack.t1059.007
- attack.persistence
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0856
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs