Unauthenticated account impersonation via null public key

Improper authentication in Progress MOVEit Transfer SFTP allows remote attackers to impersonate users through crafted public-key requests. The SFTP server passes attacker-controlled key data to IPWorks SSH as a file path, then caches an empty returned key as successfully authenticated. A valid username is required; the fileless chain injects a key into default logs and permits reading, writing, or deleting that user's files.