Managed file transfer

Managed file transfer products provide governed business-to-business file exchange through internet-facing web portals and APIs. Their exposure and the sensitive data they broker have made them prime targets: authentication bypasses and injection-to-RCE flaws in MFT appliances have driven some of the largest mass-exploitation and data-theft campaigns, notably against MOVEit, GoAnywhere, CrushFTP, and Serv-U.

1 min di letturaaggiornato il 5 ott 2026

1 contributore

Managed file transfer (MFT) products exist to move files between organizations under governance: audit, encryption, retention, and access control, exposed through a web portal and APIs that are, by design, internet-facing. That combination, external exposure plus a concentration of sensitive data from many partners, has made MFT appliances one of the most consequential target classes in recent years. The vulnerabilities cluster in two kinds: authentication bypasses that reach administrative or file functions without credentials, and injection flaws (SQL injection, deserialization, command injection) that escalate to remote code execution. Several have been exploited en masse for data theft.

bash

# fingerprint the MFT product and version
curl -skI https://<target>/                   # Server/app headers
curl -sk https://<target>/ | grep -iE 'moveit|goanywhere|crushftp|serv-u|filezilla'

Subtopics#

Authentication bypass: reaching MFT functions without credentials.
Injection to RCE: SQL injection, deserialization, and command injection.
Known MFT exploits: the specific appliance campaigns.

Managed file transfer

Subtopics#

References#