Top 6 Managed File Transfer and Secure File Sharing Tools for 2026: Compared on Patch Record

The short answer

Managed file transfer is the only software category whose public profile was built by getting breached. Every serious comparison should therefore start with the patch record, and almost none of them do. This one does.

• Fortra GoAnywhere MFT for large hybrid partner networks that need on-premises control, deployed with the admin console off the internet.
• Progress MOVEit for regulated transfers needing deep audit evidence, and prefer MOVEit Cloud unless residency forces self-hosting.
• Kiteworks for sensitive data with residency requirements and a small user population. The only vendor here with a published entry price: $25.50 per user per month.
• Cleo when file transfer and EDI are genuinely the same workflow, and after you have asked about the December 2024 incomplete patch.
• Boomi MFT if you already run Boomi. It is no longer sold standalone.
• AWS Transfer Family if you control both ends and want fully published pricing: $0.30 per protocol hour, $0.04 per GB.
• None of them if you are moving files between two systems you own. That is SFTP plus a scheduler, not a licence.

Last verified: September 2026.

Make patch and disclosure speed an explicit criterion

This is the information gain on this page. Nobody else scores it, and it is the variable that has actually decided outcomes in this category.

Ask every vendor these five questions and record the written answers next to the feature matrix:

1. Is there a dated, numbered advisory feed for this product, covering at least two years? Fortra publishes numbered advisories (the GoAnywhere deserialization flaw is FI-2025-012). Progress publishes per-product security alert bulletins on its community site and runs a public trust center. Cleo publishes security update articles in its support knowledge base. A vendor that cannot point you at a feed has already answered the question.
2. How many days elapsed between internal discovery and customer advisory for the last three critical issues? Ask for the number, not a policy statement.
3. Does the advisory state whether exploitation was observed before the patch shipped? This one separates vendors who prioritize your incident response from vendors who prioritize their own reputation. Fortra's GoAnywhere advisory carried a discovery date of 11 September 2025 while public disclosure followed later that month, and independent researchers established exploitation in that window.
4. How are affected customers contacted directly? Email to named security contacts, in-product notice, and account team outreach, or a web page you are expected to check.
5. What happened the last time a fix turned out to be incomplete? Cleo is the case study, and it is the worst failure mode in the category, because it converts a diligent customer's correct action into false assurance.

The record, with dates

Every entry below is drawn from vendor advisories or government agency advisories, not from news summaries.

Accellion FTA, December 2020. Zero-day exploitation of the legacy File Transfer Appliance hit government and private organizations internationally. Accellion rebranded to Kiteworks in October 2021 and states the flaws were confirmed only in FTA, which ran a separate codebase from the Kiteworks platform. Accellion settled related healthcare litigation for $8.1 million.

GoAnywhere MFT, February 2023. CVE-2023-0669, remote code execution. CISA advisory AA23-158A records the Cl0p group claiming data exfiltrated from approximately 130 victims over ten days.

MOVEit Transfer, May 2023. CVE-2023-34362, SQL injection. The same CISA advisory states Cl0p began exploiting it on 27 May 2023, installing the LEMURLOOT web shell to steal data from MOVEit Transfer databases. This became the defining supply chain data-theft campaign of the period.

MOVEit Transfer, June 2024. CVE-2024-5806, an authentication bypass in the SFTP module, disclosed with a Progress security bulletin and flagged by CISA.

Cleo Harmony, VLTrader, and LexiCom, December 2024. CVE-2024-50623 was patched in version 5.8.0.21 in October 2024. In December, active exploitation bypassing that patch was identified, and a second flaw, CVE-2024-55956, was fixed in 5.8.0.24. Both entered CISA's Known Exploited Vulnerabilities catalog and Cl0p claimed the campaign.

GoAnywhere MFT, September 2025. CVE-2025-10035, a deserialization flaw in the License Servlet with a CVSS score of 10.0, covered by Fortra advisory FI-2025-012 with a stated discovery date of 11 September 2025. It was exploited as a zero-day before public disclosure, added to CISA's Known Exploited Vulnerabilities catalog, and linked to Medusa ransomware deployment. Fixed in 7.8.4 and the 7.6.3 sustain release.

MOVEit Automation, April 2026. Progress disclosed CVE-2026-4670, an authentication bypass scored CVSS 9.8, chained with CVE-2026-5174 for privilege escalation, on 30 April 2026. Fixed in 2025.1.5, 2025.0.9, and 2024.1.8. No workaround exists and remediation requires a full-installer upgrade, which means planned downtime.

What the pattern actually tells you

Read across those events and one thing is constant. In every case the exploited component was internet-reachable and customer-operated. The extortion groups are not finding exotic memory corruption bugs; they are finding authentication bypasses and deserialization flaws in admin consoles and service endpoints that were exposed to the whole internet because that was the easiest way to deploy.

Three consequences for how you buy:

• Network placement beats product choice. The admin console belongs on a private network segment. Partner-facing protocols belong in a DMZ proxy tier, not on the application server. That architecture would have blunted most of the events above regardless of vendor.
• Patch capability is a purchase criterion about you, not the vendor. If your change process cannot ship an emergency patch to an internet-facing application within 48 hours, self-hosted MFT is the wrong choice. A vendor-managed cloud option is the honest one.
• A clean record is not proof of safety. Boomi MFT and AWS Transfer Family have no public mass-exploitation event, which is genuinely worth something, and it partly reflects architecture (no customer-operated appliance) and partly reflects smaller installed bases. Do not read it as a guarantee.

Who is still an independent purchase

This market consolidated while nobody was watching, and a lot of comparison content has not caught up.

Thru no longer exists as a vendor. Boomi announced its acquisition on 15 May 2025, and the technology is now Boomi Managed File Transfer inside the Boomi Enterprise Platform. The thruinc.com domain redirects to Boomi. If a comparison still lists Thru as an independent option, it was written from stale data. For a buyer with no Boomi footprint, this means evaluating an entire enterprise integration platform to obtain file transfer, which is rarely the right trade.

Kiteworks is Accellion renamed, since October 2021. That is not a criticism, and the FTA codebase distinction the company draws is technically real. It still belongs in your evaluation, because the organizational question does not transfer to a new brand: how the vendor behaved during an incident, and what changed afterwards.

The rest (Fortra, Progress, Cleo, AWS) remain straightforwardly purchasable as of September 2026.

The cloud-native alternative, honestly

AWS Transfer Family is the option most buyers should price out before signing an MFT licence, and the option most of them will correctly reject.

What you get: managed SFTP, FTPS, FTP, and AS2 endpoints in front of Amazon S3 or EFS. Identity comes through IAM or your directory, and logging through CloudWatch. Published rates for US East (N. Virginia) are $0.30 per protocol hour and $0.04 per GB for SFTP, FTPS, and FTP. AS2 is $0.01 per message up to 50 MB for the first 100,000 monthly messages. Web app units cost $0.50 per hour for 250 concurrent sessions, and PGP decrypt workflows $0.10 per GB.

What you do not get: trading-partner onboarding, partner credential self-service, EDI translation, retry and escalation workflow, packaged non-repudiation reporting, or an operations console anyone outside engineering can use. Azure and Google Cloud have comparable gaps in their equivalents.

The decision rule is simple. If you control both ends, or your partners are few and technical, the cloud service is cheaper, more transparent, and has no appliance for you to misconfigure. If you onboard hundreds of external partners with varied protocol demands and somebody in operations needs a console, you are buying an MFT product whether you want to or not.

Where this sits in the rest of the stack

Managed file transfer is one control in a data protection story, not the whole of it.

• The data loss prevention tools comparison covers classifying and stopping the data before it reaches a transfer channel.
• The secure email providers comparison covers the person-to-person channel that MFT is frequently, and wrongly, bought to replace.
• The vulnerability management platform comparison covers knowing you are running the affected version on the day the advisory lands, which is the difference between a 48-hour patch and a breach notification.
• The ransomware backup and recovery comparison covers what happens after, since Medusa ransomware deployment followed the September 2025 GoAnywhere exploitation.
• The external attack surface management comparison covers finding the MFT admin console somebody exposed to the internet three years ago and forgot.

Who should not buy this category

• Internal-only file movement. Two systems you own, inside one network boundary: use SFTP with key-based authentication, a scheduler, and monitoring. MFT adds licence cost, administrative weight, and an internet-facing attack surface for governance features you will never invoke.
• Occasional person-to-person document sharing. If the requirement came from legal or finance needing to send sensitive documents to outside counsel, that is secure file sharing. Your existing collaboration suite with data loss prevention, or a governed sharing product, is cheaper and less exposed.
• Organizations that cannot patch an internet-facing application within days. Every event documented above punished exactly that. If the staffing is not there, do not buy a self-hosted appliance. Buy a vendor-managed service and make patching someone else's contractual obligation.

How we evaluated

Last verified: September 2026.

Most managed file transfer comparisons score protocol checkboxes. Protocol support is table stakes across this shortlist, and it has never been the variable that decided an outcome. These are the dimensions used here:

• Security track record, with dates. Documented mass-exploitation events, the CVE identifiers, the fixed versions, and whether exploitation preceded disclosure. Every claim carries a date so it can be checked and so it ages visibly.
• Patch and disclosure behaviour. Whether the vendor publishes a dated advisory feed, whether advisories state observed exploitation, and what happened when a fix proved incomplete.
• Deployment model and who patches. Customer-operated appliance, vendor-managed cloud, or a managed service with no appliance at all. This determines which of the documented failure modes you inherit.
• Pricing transparency. Whether a real number exists on a vendor page, and what it covers.
• Corporate status. Whether the product is still an independent purchase, since this market consolidated during 2025.

What we checked

Product and pricing claims come from vendor pages read in September 2026. Exploitation claims come from vendor security advisories or from government agency advisories, never from a news summary or another comparison site.

• Kiteworks pricing page and its Business package store listing for the $25.50 per user per month figure, the stated 40% annual-billing discount, and the 5 to 100 user store range. The same pages give the 2 GB file size cap, 1 TB storage, 50 GB monthly bandwidth, and selectable hosting regions. They also state the Enterprise edition's call-for-pricing status, with unlimited users and a 16 TB file size ceiling.
• AWS Transfer Family pricing for every published rate quoted on this page, taken at US East (N. Virginia).
• Fortra's GoAnywhere pricing page for the licensing model (by module or server component per instance, with Secure Mail and GoDrive priced per user) and to confirm no figures are published.
• Progress MOVEit for product structure and to confirm pricing is quote-only with a 30-day trial.
• Boomi's managed file transfer platform page and the acquisition announcement dated 15 May 2025. We separately confirmed that thruinc.com now redirects into Boomi's platform pages, which is why Thru is listed here under its current name.

For the exploitation history:

• CISA advisory AA23-158A for CVE-2023-34362 in MOVEit Transfer, the 27 May 2023 start of Cl0p exploitation, and the LEMURLOOT web shell. The same advisory states that this group claimed data from approximately 130 GoAnywhere victims over ten days following CVE-2023-0669.
• Fortra advisory FI-2025-012 for CVE-2025-10035, its CVSS 10.0 rating, the 11 September 2025 discovery date, and the fixed releases 7.8.4 and 7.6.3.
• Cleo's own product security update article for CVE-2024-55956 and the 5.8.0.24 fix, alongside the October 2024 5.8.0.21 patch for CVE-2024-50623 that was subsequently bypassed in December 2024.
• Progress's MOVEit Automation critical security alert bulletin for April 2026 for CVE-2026-4670 and CVE-2026-5174, the 30 April 2026 disclosure, the fixed versions, and the absence of a workaround.

What we could not verify

Several vendor sites block automated retrieval. Fortra's pricing and advisory pages, Cleo's support knowledge base, and Progress's community advisory all return access errors to a crawler. Details from those sources were confirmed through their indexed content and cross-checked against the government advisories above, rather than read directly end to end. The CVE identifiers, CVSS scores, dates, and fixed version numbers are consistent across those sources. Confirm the current fixed versions on the vendor advisory itself before you plan an upgrade, because sustain-release version numbers change.

CISA Known Exploited Vulnerabilities catalog inclusion is stated here for CVE-2023-0669, CVE-2024-50623, CVE-2024-55956, and CVE-2025-10035 based on the corresponding agency and vendor advisories. Check the live catalog for current entries and due dates if you are using this for compliance purposes.

We found no published price for GoAnywhere, MOVEit, Cleo, or Boomi MFT, and we did not substitute an aggregator estimate for any of them. Specific dollar ranges circulate widely for these products and none of them is a vendor commitment.

What we did not do

We did not run these products, and this page makes no hands-on testing claims. Rankings reflect documented capability, published pricing, deployment model, corporate status, and the dated public security record.

We did not use the absence of a public exploitation event as evidence of superior engineering. Boomi MFT and AWS Transfer Family have no such event, which partly reflects architecture and partly reflects installed base and attacker attention. It is a real advantage and it is not a guarantee.

We did not rank vendors down for having disclosed vulnerabilities. Every product of this complexity has them. What is scored here is how fast the vendor moved, how clearly it told customers, and what it did when a fix was incomplete.