Cyber Resilience

CVE-2026-8649

Progress Moveit Transfer ≤ 2025.0.7

Published
08 July 2026
Modified
10 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0026 17th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2026-8649 is a medium-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Progress Moveit Transfer. Its CVSS base score is 6.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CWE(s)
CWE-943

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an improper neutralization of special elements in data query logic (CWE-943) affecting a public-facing file transfer application (MOVEit Transfer), directly enabling exploitation of a remote service via crafted input to execute unauthorized queries or commands.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability is an injection flaw in a web-facing application (MOVEit Transfer), directly enabling exploitation of a public-facing service.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Successful exploitation of the query-logic injection could allow arbitrary command or script execution within the MOVEit environment.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-10698Same product: Progress Moveit Transfer
CVE-2026-8651Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2026-10699Same product: Progress Moveit Transfer
CVE-2023-42656Same product: Progress Moveit Transfer
CVE-2023-36932Same product: Progress Moveit Transfer
CVE-2023-36934Same product: Progress Moveit Transfer
CVE-2023-6218Same product: Progress Moveit Transfer
CVE-2025-13147Same product: Progress Moveit Transfer
CVE-2023-6217Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
≤ 2025.0.7 · 2025.1.0 — 2025.1.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)
  • SI-2 Flaw Remediation
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Enforces validation of all input used in data queries, directly blocking the special-element injection that enables the MOVEit Custom Reports flaw.

AC-6 Least Privilege partial match
prevent

Limits the privileges of accounts that can create or run custom reports, reducing the impact if an attacker exploits the query-injection vulnerability.

SI-2 Flaw Remediation partial match
preventrespond

Requires prompt application of vendor patches (2025.0.7 / 2025.1.3) that remediate the improper neutralization in MOVEit Transfer.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for controls against injection and improper query construction.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements in all data queries.

A.8.30 Outsourced development partial match
prevents

Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.

References