CVE-2026-8649

—

CVSS 3.1

9.8 critical

EPSS

<1%p17

Published

Jul 8, 2026 (Jul 8, 2026)

Modified

Jul 10, 2026

Description

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Vendors: progress
Products: moveit transfer
Weakness: CWE-943
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.