Cyber Resilience

CVE-2026-8650

Path Traversal in Progress Moveit Transfer ≤ 2025.0.7

Published
08 July 2026
Modified
09 July 2026
CVSS Score v3.1 4.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0037 29th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-8650 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Progress Moveit Transfer. Its CVSS base score is 4.5 (Medium).

Operationally, ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1083 File and Directory Discovery Discoveryconfidence: HIGH
Relative path traversal in Admin Settings module enables arbitrary file and directory discovery on the MOVEit Transfer server.
T1005 Data from Local System Collectionconfidence: MEDIUM
Path traversal can be abused to read sensitive files from the local system outside intended directories.
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Vulnerability in a public-facing web application (MOVEit Transfer Admin Settings) allows remote attackers to exploit it directly.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-10699Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2023-42656Same product: Progress Moveit Transfer
CVE-2023-36932Same product: Progress Moveit Transfer
CVE-2023-36934Same product: Progress Moveit Transfer
CVE-2023-6218Same product: Progress Moveit Transfer
CVE-2025-13147Same product: Progress Moveit Transfer
CVE-2023-6217Same product: Progress Moveit Transfer
CVE-2023-40043Same product: Progress Moveit Transfer
CVE-2026-8649Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
≤ 2025.0.7 · 2025.1.1 — 2025.1.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces access-control decisions so that path-traversal inputs cannot cause the MOVEit Admin Settings module to access or modify files outside the intended directory.

prevent

Requires validation of all user-supplied input, directly blocking the relative path traversal strings that trigger CVE-2026-8650.

prevent

Boundary-protection mechanisms can be configured to restrict or inspect traffic to the Admin Settings endpoints, limiting exposure to the vulnerable path-traversal vectors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.

prevents

Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.

prevents

Application security requirements explicitly call for controls against path traversal and other injection flaws.

prevents

Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.

prevents

Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.

mitigates

Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.

References