CVE-2026-8649

Full vulnerability record from the local CVENow database.
Description

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Severity
CRITICAL
CVSS score
9.8 (v3.1)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-07-08 20:17:00.557000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
  "id": "CVE-2026-8649",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T20:17:00.557",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).\n\nThis issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales en la Lógica de Consulta de Datos en Progress MOVEit Transfer (módulos de Informes Personalizados).\n\nEste problema afecta a MOVEit Transfer: antes de 2025.0.7, desde 2025.1.0 antes de 2025.1.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Progress",
          "product": "MOVEit Transfer",
          "defaultStatus": "unaffected",
          "modules": [
            "Custom Reports"
          ],
          "versions": [
            {
              "version": "2025.1.0",
              "lessThan": "2025.1.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2025.0.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T13:28:38.467051Z",
          "id": "CVE-2026-8649",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2025.0.7",
              "matchCriteriaId": "E1F696CA-EE0E-4665-8D8B-BE9F2214E50E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2025.1.0",
              "versionEndExcluding": "2025.1.3",
              "matchCriteriaId": "B84E088D-58A8-436D-86CF-DAFA6EC4023C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Release Notes"
      ]
    }
  ]
}