Introduction
Denial-of-service attacks on secure file transfer infrastructure can disrupt critical business operations and regulatory data exchanges. CVE-2025-10932, the latest uncontrolled resource consumption vulnerability in the AS2 module of Progress MOVEit Transfer, exposes organizations to significant operational risk if left unpatched.
About MOVEit Transfer and Progress Software: Progress Software is a major enterprise software vendor with a global customer base, best known for MOVEit Transfer. MOVEit Transfer is widely used for secure file transfer in regulated industries, government, and large enterprises. The AS2 module is a core component for secure B2B file exchange, so this vulnerability is especially serious for organizations with compliance requirements.
Technical Information
CVE-2025-10932 is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw is in the AS2 module of MOVEit Transfer, which processes the Applicability Statement 2 (AS2) protocol messages used for secure business-to-business file transfers. An attacker can exploit it by sending crafted AS2 messages or sequences of requests that make the system consume excessive resources, such as memory or CPU. The result can be degraded service or a complete denial of service that blocks legitimate file transfers.
The root cause is insufficient resource management in the AS2 message-processing logic. The module does not adequately limit or throttle resource use per connection or per message, which lets attackers overwhelm the application. No public code snippets or stack traces are available yet. Attackers may not need to authenticate, because AS2 endpoints are often exposed to external partners by design.
Affected Systems and Versions
- MOVEit Transfer 2025.0.0 before 2025.0.3
- MOVEit Transfer 2024.1.0 before 2024.1.7
- MOVEit Transfer 2023.1.0 before 2023.1.16
All deployments with the AS2 module enabled and accessible are at risk. No information is available on configuration dependencies beyond the version and whether the module is exposed.
Vendor Security History
MOVEit Transfer has a documented history of critical vulnerabilities. CVE-2023-34362, a SQL injection flaw, was exploited at scale in 2023 and led to major data breaches. Several more MOVEit Transfer vulnerabilities have been disclosed and patched since then, including authentication bypass and resource management issues. Progress generally patches quickly and keeps public advisories up to date, but the frequency of critical flaws has raised concerns about the security maturity of its development lifecycle.
