CVE-2023-34362: MOVEit Transfer SQL injection (Cl0p)

CVE-2023-34362 is a critical (CVSS 9.8) SQL injection vulnerability in Progress MOVEit Transfer that let an unauthenticated attacker read and manipulate the underlying database; the Cl0p ransomware group exploited it as a zero-day starting around 2023-05-27 to steal data from thousands of organizations worldwide.

CVE-2023-34362 is a SQL injection vulnerability in the MOVEit Transfer web application. An unauthenticated attacker who sends a crafted request can gain unauthorized access to MOVEit Transfer's database and, depending on whether the backend is MySQL, Microsoft SQL Server or Azure SQL, infer information about the database's structure and contents or execute statements that alter or delete data (NVD).

NVD scores the flaw CVSS v3.1 9.8 (critical): network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD's own vulnerability note records that the flaw "is exploited in the wild in May and June 2023" and that exploitation of unpatched systems can occur over either HTTP or HTTPS (NVD).

CISA added CVE-2023-34362 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-06-02, the same day it was published, with a required-action due date of 2023-06-23 and records known use in ransomware campaigns (CISA KEV).

A joint CISA/FBI advisory (AA23-158A) describes how, beginning around 2023-05-27, the Cl0p (TA505) ransomware group exploited this vulnerability as a zero-day to install a web shell named LEMURLOOT on vulnerable MOVEit Transfer servers and exfiltrate data from the underlying database, rather than encrypting files; CISA and the FBI state the group has compromised thousands of organizations globally using this and related techniques, and recommend asset inventory, software allow-listing, MFA and network segmentation as mitigations (CISA Advisory AA23-158A).

As of 2026-10-20, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9993, 99.971st percentile) (FIRST EPSS).

Any MOVEit Transfer or MOVEit Cloud instance on an affected release should be upgraded to the fixed version for its branch, and organizations that ran an affected version during the May–June 2023 exploitation window should review logs for signs of the LEMURLOOT web shell or unexpected database access described in the joint advisory.

• Unauthenticated SQL injection in the MOVEit Transfer web application allows unauthorized database access and, depending on the database engine, data inference or alteration. — NVD
• NVD CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD's own note records exploitation in the wild in May and June 2023. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2023-06-02, due date 2023-06-23, with known ransomware campaign use. — CISA KEV
• The Cl0p (TA505) ransomware group exploited this vulnerability as a zero-day from around 2023-05-27 using a web shell named LEMURLOOT to exfiltrate data, compromising thousands of organizations globally. — CISA Advisory AA23-158A
• EPSS score is 0.9993 (99.971st percentile) as of 2026-10-20. — FIRST EPSS