Called exploited 1 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last KEV listing1d
- Last sighting3.3y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Jun 2, 2023
- EUVDENISA, European Unionlisted Jun 2, 2023
- VulnCheck KEVcommercial researchlisted Jun 1, 2023
- CIRCLaggregator, mirrors the abovelisted Jun 2, 2023, not counted
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationcyble.com/blog/supply-chain-attacks-in-2026-vendor-risk/
- reported exploitationreliaquest.com/blog/clop-returns-with-custom-implant-in-mass
- reported exploitationwww.team-cymru.com/post/cl0p-ransomware-mft-attack-pattern-t
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-3
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-3
122 public reports collected from VulnCheck and CIRCL, first on Jun 1, 2023. Each links to its original source. We have not verified them.
Description
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
Required action (CISA)
Apply updates per vendor instructions.
