# Progress MOVEit Transfer patches multiple flaws

Published: 2026-07-10 · Severity: medium · Sectors: technology
Canonical: https://vorant.io/reports/193010ed-fef2-5f5f-a592-ecfe46ad737f/progress-moveit-transfer-patches-multiple-flaws

> Progress patched several MOVEit Transfer vulnerabilities allowing privilege escalation, data exposure, and XSS in versions before 2026.0.2.

CERT-FR issued an advisory for multiple vulnerabilities discovered in Progress MOVEit Transfer, a widely used managed file transfer product. The flaws affect MOVEit Transfer 2026.x releases prior to version 2026.0.2 and could allow an attacker to escalate privileges, compromise data confidentiality, and perform indirect remote code injection via cross-site scripting (XSS).

Three CVEs are referenced (CVE-2026-10698, CVE-2026-10699, CVE-2026-11903). No evidence of active exploitation is mentioned in the advisory. Progress has released patched version 2026.0.2 and affected organizations are advised to consult the vendor's security bulletin and apply the fix.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10698, CVE-2026-10699, CVE-2026-11903

## Detection guidance (public sample)

### IIS Worker Process Spawning Command Shell (Possible MOVEit Transfer Exploitation)

ATT&CK: T1068

Detects w3wp.exe (IIS application pool worker, e.g. hosting MOVEit Transfer) spawning a command interpreter, consistent with post-exploitation after a privilege-escalation or RCE flaw in a web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Command Shell
id: 606aa153-d54f-5e30-bd69-de8e089a758f
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe,
  cscript.exe or wscript.exe, a pattern consistent with exploitation of a vulnerable
  web application such as MOVEit Transfer leading to privilege escalation or remote
  code execution.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
  filter:
    CommandLine|contains:
    - C:\Windows\System32\inetsrv\
  condition: selection and not filter
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks executed through
  IIS application pool identity
- Custom application health-check or diagnostic scripts invoked by the web application
level: high
tags:
- attack.t1068
- attack.privilege_escalation
```

### Web Application Worker Process Writing Script or Web Shell Files

ATT&CK: T1068

Detects w3wp.exe writing script files (.aspx, .asp, .js, .jsp) to the web application directory, indicative of a web shell drop following exploitation of a vulnerability such as those patched in MOVEit Transfer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Writing Script Files to Web Root
id: dd72f1ac-5bd3-53a3-a16e-826eb29faab6
status: experimental
description: Detects the IIS worker process (w3wp.exe) creating executable script
  files (.aspx, .asp, .js, .jsp) within web application directories, which can indicate
  a web shell dropped after exploitation of a managed file transfer or web application
  vulnerability.
references:
- https://www.cert.ssi.gouv.fr/
author: Vorant
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \w3wp.exe
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .js
    - .jsp
  filter:
    TargetFilename|contains:
    - \App_Data\
    - \bin\
  condition: selection and not filter
falsepositives:
- Application deployment or update processes that legitimately publish new script
  files under the web application context
- Content management or file transfer application functionality that writes user-uploaded
  scripts to non-executable storage paths
level: medium
tags:
- attack.t1068
- attack.t1059.007
- attack.persistence
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0856

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/193010ed-fef2-5f5f-a592-ecfe46ad737f/progress-moveit-transfer-patches-multiple-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup