Cyber Resilience

CVE-2026-10698

Progress Moveit Transfer ≤ 2024.1.8

Published
08 July 2026
Modified
10 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0050 40th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-10698 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Progress Moveit Transfer. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

CWE(s)
CWE-943

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an improper neutralization of special elements in data query logic (CWE-943) affecting a public-facing file transfer application (MOVEit Transfer), directly enabling exploitation of a remote service via crafted input to execute unauthorized queries or commands.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8649Same product: Progress Moveit Transfer
CVE-2026-8651Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2026-10699Same product: Progress Moveit Transfer
CVE-2023-42656Same product: Progress Moveit Transfer
CVE-2023-36932Same product: Progress Moveit Transfer
CVE-2023-36934Same product: Progress Moveit Transfer
CVE-2023-6218Same product: Progress Moveit Transfer
CVE-2025-13147Same product: Progress Moveit Transfer
CVE-2023-6217Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
2026.0.0 · ≤ 2024.1.8 · 2025.0.0 — 2025.0.8 · 2025.1.0 — 2025.1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)
  • SI-2 Flaw Remediation
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of all input used in data queries, preventing injection of special elements into MOVEit Transfer Custom Reports.

AC-6 Least Privilege partial match
prevent

Limits privileges of accounts that can create or run custom reports, reducing the impact of successful query manipulation.

SI-2 Flaw Remediation partial match
preventrespond

Requires timely application of vendor patches that remediate the improper neutralization flaw in MOVEit Transfer versions listed in the CVE.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for controls against injection and improper query construction.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements in all data queries.

A.8.30 Outsourced development partial match
prevents

Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.

References