Progress MOVEit Transfer patches multiple flaws
Progress patched several MOVEit Transfer vulnerabilities allowing privilege escalation, data exposure, and XSS in versions before 2026.0.2.
CERT-FR issued an advisory for multiple vulnerabilities discovered in Progress MOVEit Transfer, a widely used managed file transfer product. The flaws affect MOVEit Transfer 2026.x releases prior to version 2026.0.2 and could allow an attacker to escalate privileges, compromise data confidentiality, and perform indirect remote code injection via cross-site scripting (XSS).
Three CVEs are referenced (CVE-2026-10698, CVE-2026-10699, CVE-2026-11903). No evidence of active exploitation is mentioned in the advisory. Progress has released patched version 2026.0.2 and affected organizations are advised to consult the vendor's security bulletin and apply the fix.
Mentioned in this report
Detection guidance
IIS Worker Process Spawning Command Shell (Possible MOVEit Transfer Exploitation)
Detects w3wp.exe (IIS application pool worker, e.g. hosting MOVEit Transfer) spawning a command interpreter, consistent with post-exploitation after a privilege-escalation or RCE flaw in a web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Command Shell
id: 606aa153-d54f-5e30-bd69-de8e089a758f
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe,
cscript.exe or wscript.exe, a pattern consistent with exploitation of a vulnerable
web application such as MOVEit Transfer leading to privilege escalation or remote
code execution.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
filter:
CommandLine|contains:
- C:\Windows\System32\inetsrv\
condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks executed through
IIS application pool identity
- Custom application health-check or diagnostic scripts invoked by the web application
level: high
tags:
- attack.t1068
- attack.privilege_escalation
Web Application Worker Process Writing Script or Web Shell Files
Detects w3wp.exe writing script files (.aspx, .asp, .js, .jsp) to the web application directory, indicative of a web shell drop following exploitation of a vulnerability such as those patched in MOVEit Transfer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Writing Script Files to Web Root
id: dd72f1ac-5bd3-53a3-a16e-826eb29faab6
status: experimental
description: Detects the IIS worker process (w3wp.exe) creating executable script
files (.aspx, .asp, .js, .jsp) within web application directories, which can indicate
a web shell dropped after exploitation of a managed file transfer or web application
vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|endswith:
- .aspx
- .asp
- .js
- .jsp
filter:
TargetFilename|contains:
- \App_Data\
- \bin\
condition: selection and not filter
falsepositives:
- Application deployment or update processes that legitimately publish new script
files under the web application context
- Content management or file transfer application functionality that writes user-uploaded
scripts to non-executable storage paths
level: medium
tags:
- attack.t1068
- attack.t1059.007
- attack.persistence
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0856
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free