CVE-2023-35708

✓ Confirmed 0-Day

Triaged: March 20, 2026 1 article

VulnLookup ↗ NVD ↗ MITRE ↗

EPSS Score

Source: FIRST.org · 2026-05-24

76.74%

probability

This CVE has a 76.74% probability of being exploited in the next 30 days.

0% Top 99.0th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-707 · Improper Neutralization CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-89 · SQL Injection CWE-943 · Improper Neutralization of Special Elements in Data Query Logic

Third Flaw Uncovered in MOVEit Transfer App Amidst Cl0p Ransomware Mass Attack

TheHackerNews

Signal Intelligence

Confidenceⓘ

75%

EPSS 76.74%

Mentions 1

CNA Information

Analyst Note

CVE-2023-35708 is a MOVEit Transfer SQL injection vulnerability disclosed by Progress Software in 2023 during active Cl0p ransomware exploitation campaign. The CVE was disclosed as part of an actively exploited vulnerability cluster (MOVEit zero-days), and the article explicitly contextualizes it within the Cl0p mass attack, indicating exploitation in the wild coinciding with or preceding vendor disclosure.

Threat Actors 6

Hacking Team

apt_group 🇮🇹 IT

Volt Typhoon

apt_group Information theft and espionage 🇨🇳 CN

APT 22

apt_group Information theft and espionage 🇨🇳 CN

APT 6

apt_group Information theft and espionage 🇨🇳 CN

Mana Team

apt_group 🇨🇳 CN

APT 5

apt_group Information theft and espionage 🇨🇳 CN

Triage Info

Decided atMar 20, 2026