In May 2023, a single SQL injection vulnerability in Progress Software's MOVEit Transfer became the vehicle for one of the largest supply chain breaches on record. The Clop ransomware group exploited CVE-2023-34362, rated 9.8 out of 10 on the CVSS severity scale, before a patch even existed. By the time the breach was contained, more than 2,700 organizations had been compromised and approximately 93.3 million individuals had their personal data exposed, according to CoverLink's analysis of the incident. Victims included the BBC, British Airways, the US Department of Energy, and hundreds of downstream organizations that had no direct relationship with MOVEit but were exposed through vendors who did.
That was not the end of the story. MOVEit has since accumulated at least 11 disclosed CVEs across three product lines, including five rated CVSS 9.0 or higher, according to a detailed vulnerability record published by Kiteworks. As recently as May 2026, a new critical authentication bypass vulnerability, CVE-2026-4670, was disclosed in MOVEit Automation — the third critical vulnerability wave to hit the platform in three years.
MOVEit is not an outlier. It is a pattern.
The NIST National Vulnerability Database is a public record. Any organization evaluating file transfer software can search it directly. Here is what that search reveals across the most widely deployed platforms in the market.
GoAnywhere MFT disclosed CVE-2023-0669, a pre-authentication remote code execution vulnerability that was actively exploited by ransomware groups before a patch was available. In September 2025, CVE-2025-10035 was added to CISA's Known Exploited Vulnerabilities catalog with a maximum CVSS score of 10.0, allowing remote code execution without authentication. A further information disclosure vulnerability, CVE-2026-1089, was disclosed in April 2026, allowing unauthenticated remote attackers to trigger DNS lookups and potential data exfiltration through manipulated HTTP headers. GoAnywhere continues to receive new CVE disclosures with each passing year.
Titan FTP has accumulated CVEs spanning two decades. Rapid7 discovered that Titan MFT and Titan SFTP contained path traversal vulnerabilities allowing an authenticated user to access any file on the filesystem, including /etc/shadow, with the service running as root. CVE-2022-34005 documented hard-coded credentials embedded in the product. CVE-2022-34006 documented incorrect permission assignment for critical resources. CVE-2022-44215 documented an open redirect vulnerability. CVE-2023-22629 documented a path traversal vulnerability in the movefile function. Earlier versions carried heap-based buffer overflow vulnerabilities in core FTP command handling dating to 2004. The pattern across all of these is consistent: insufficient input validation and insecure defaults.
JSCAPE MFT was found by Rapid7 to contain a Java deserialization vulnerability in its management interface, assigned CVE-2023-4528. Successful exploitation allowed remote code execution as root on Linux or SYSTEM on Windows — full administrative control of the affected server. The vulnerability existed in an XML parser used by the management service, which accepted and processed attacker-controlled Java objects without adequate validation. A separate researcher subsequently identified that JSCAPE's default installation bundled an outdated H2 database library carrying its own known critical vulnerabilities, CVE-2022-23221 and CVE-2021-42392. Both vulnerabilities trace back to the same root cause: inherited exposure from third-party library dependencies that were not kept current.
Fortra's GlobalScape EFT has accumulated CVEs across multiple product lines. Rapid7 documented an out-of-bounds memory read in the administration server of versions before 8.1.0.16, allowing an attacker to crash the service or bypass authentication. Earlier product lines including CuteFTP carried heap-based buffer overflow vulnerabilities enabling remote code execution, directory traversal flaws, and cross-site request forgery vulnerabilities across different versions. GlobalScape itself acknowledged in its knowledge base that most of its reported vulnerabilities center on web application security practices such as anti-CSRF techniques, cookie handling, and header configuration.
SFTPGo, a widely used open source file transfer platform, has accumulated several CVEs in recent versions. CVE-2024-52309 documented a privilege escalation vulnerability in the EventManager feature, where administrators with script execution permissions could access the underlying operating system with the same permissions as the SFTPGo service account. A separate JWT implementation vulnerability was disclosed in version 2.6.2, where missing JWT ID claims, nonces, and expiration mechanisms weakened authentication security. A two-factor authentication bypass was documented in versions 2.2.0 through 2.3.3, where recovery codes could be generated before 2FA was enabled, creating a window for an attacker who knew the password to bypass the second factor after it was activated. An input validation vulnerability in dynamic group path handling was disclosed in versions prior to 2.7.1. Open source software carries no inherent security advantage over commercial software. The CVE record reflects the code, not the license model.
Cerberus FTP Server has accumulated CVEs going back to 2007, including cross-site scripting vulnerabilities, cross-site request forgery flaws allowing unauthenticated attackers to add user accounts or reconfigure the FTP service, buffer overflow vulnerabilities, permission bypass issues allowing authenticated users to access hidden files and directories, and a reflected XSS vulnerability through image elements in the web client. CVE-2023-50452 documented an authenticated user full path disclosure vulnerability in versions prior to 13.2.1. Each of these vulnerability classes reflects a distinct engineering failure: unvalidated output, missing CSRF tokens, improper bounds checking, and insufficient permission enforcement.
File transfer software occupies a specific position in enterprise architecture that makes it structurally attractive to attackers. It sits at the perimeter. It accepts connections from external parties. It handles the most sensitive data in the organization. And it is deployed at scale across thousands of customers, meaning a single exploitable vulnerability provides access not to one organization but to every organization running the affected version.
SecurityScorecard research found that file transfer tools have become the primary third-party breach vector, with just two exploit campaigns against MOVEit and Cleo MFT accounting for 63.5% of all vulnerability-driven third-party breaches in their analysis period. The Clop ransomware group alone was responsible for 41.5% of attributable third-party breaches, largely through its exploitation of file transfer vulnerabilities.
The economics of this are straightforward. A vulnerability in a widely deployed file transfer platform is worth far more to an attacker than a vulnerability in a niche application. The investment in finding and weaponizing the exploit is amortized across every customer running the affected software. Attackers understand this arithmetic. File transfer software has become the preferred category for large-scale supply chain attacks precisely because the leverage is so significant.
Understanding why specific platforms accumulate CVEs requires looking at the engineering decisions that create vulnerability exposure in the first place.
Most enterprise software is not written entirely from scratch. It relies on third-party libraries for cryptographic functions, network handling, data parsing, and dozens of other capabilities. Each dependency is a potential source of vulnerabilities that the vendor did not write and may not discover until they are publicly disclosed.
The MOVEit CVE-2024-5806 vulnerability is a direct illustration: the severity was initially rated 7.4, then upgraded to 9.1 when a third-party IPWorks SSH library vulnerability was disclosed that affected the same codebase. JSCAPE's exposure through an outdated H2 database library is another: the vulnerability existed in a component the vendor bundled but did not write. Platforms that minimize external dependencies reduce this exposure structurally. Every library that is not included is an attack surface that does not exist.
The larger and more complex a codebase, the larger the surface available for attack. File transfer platforms that have grown through acquisition or feature accumulation over decades tend to carry architectural debt: legacy code that was never designed with current threat models in mind, features that create interaction effects no single developer fully understood, and integrations that expose internal functionality to external input in ways that were not anticipated.
SQL injection, the vulnerability class that enabled the MOVEit breach, is one of the oldest and best-understood vulnerability categories in software security. Its presence in a product deployed to thousands of enterprise customers in 2023 reflects not just a coding error but an architectural posture that did not treat external input as adversarial by default.
Vulnerabilities that are discovered and patched generate CVEs. A vendor with an active, transparent security program will accumulate CVEs over time simply by finding and fixing issues. The meaningful distinction is between CVEs that were discovered internally and patched before exploitation, versus CVEs that were discovered externally, often by attackers, and exploited in the wild before a patch was available.
The MOVEit CVE-2023-34362 vulnerability was being actively exploited in late May 2023, before Progress Software had any public knowledge of it. According to the subsequent class action lawsuit, the vulnerability had existed since 2021, two years during which it could have been found internally and fixed without any customer exposure.
Rapid7 research found that 56% of high-profile vulnerabilities are exploited within a week of discovery, with over 40% of widespread attacks commencing with a zero-day exploit. The window between disclosure and exploitation has collapsed to days or hours for high-value targets. For widely deployed file transfer software, the exploitation window for a critical vulnerability is effectively zero: attackers have reverse-engineered patches faster than most organizations can apply them.
This makes the pre-exploitation security posture of the software itself the only reliable defense. Patching is essential but not sufficient when exploits are available before patches are applied.
The zero CVE record of certain platforms is sometimes attributed to obscurity: if fewer people are looking for vulnerabilities, fewer vulnerabilities are found. This explanation does not hold up to scrutiny. A platform like Syncplify Server!, that has been in continuous production use by enterprise customers since 2014, handling sensitive file transfers across regulated industries, is not obscure. It is a platform that has been subjected to real-world scrutiny across more than a decade of deployments and has not accumulated publicly recorded vulnerabilities.
Several engineering disciplines contribute to this outcome.
Minimizing external dependencies reduces the inherited attack surface from third-party libraries. Every dependency that is not present cannot introduce a vulnerability.
Treating all external input as adversarial means that data arriving from the network, regardless of the channel, is validated and sanitized before being processed. SQL injection, command injection, and deserialization vulnerabilities all share a common root: trusting input that should not be trusted. Architectural discipline around this assumption closes an entire class of vulnerabilities at the design level.
Maintaining a small, well-understood codebase reduces the surface available for attack and makes it possible for developers to reason about security implications across the entire system. Complexity is the enemy of security. Every feature that is not necessary is an attack surface that does not need to exist.
Continuous internal security review means vulnerabilities are found before attackers find them. The cadence and rigor of internal review directly determines whether CVEs are discovered and patched quietly or discovered externally and exploited.
The NIST National Vulnerability Database is a public record. Before deploying any file transfer platform in a production environment, it is worth spending five minutes searching for the product name and reviewing what has been publicly disclosed. The number of CVEs, their severity ratings, whether they were exploited in the wild, and how quickly patches were issued all provide meaningful signals about the vendor's security engineering practices.
A platform with zero entries in the NVD since its inception is not making a marketing claim. It is pointing to a verifiable public record that any organization can check independently. That is a meaningfully different evidentiary standard than a vendor's assertion that their platform is secure.
The file transfer layer handles your most sensitive data. The organizations that were compromised in the MOVEit breach did not choose to be part of a supply chain attack. Many of them had no direct relationship with the software that was exploited. But the data moved through it, and when the vulnerability was exploited, that data was gone.
The question of which file transfer platform to deploy is, in regulated industries and high-value environments, a risk management decision. The CVE record is one of the most concrete inputs available for making that decision well.
