Cyber Resilience

CVE-2026-8651

Auth Bypass in Progress Moveit Transfer ≤ 2025.0.7

Auth Bypass
Published
08 July 2026
Modified
09 July 2026
CVSS Score v3.1 3.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0022 12th percentile
Risk Priority 16 floored blend · peak EPSS

Summary

CVE-2026-8651 is a low-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Progress Moveit Transfer. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CWE(s)
CWE-290

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an authentication bypass in the HTTPS module of a public-facing file transfer application, directly enabling remote exploitation of a publicly accessible service (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Authentication bypass in the HTTPS module of a public-facing file transfer server directly enables exploitation of a remote service without valid credentials.
attack.mitre.org →
T1078 Valid Accounts Stealthconfidence: MEDIUM
Spoofing-based bypass allows an attacker to appear as a valid account, facilitating use of valid (or impersonated) accounts for access.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8649Same product: Progress Moveit Transfer
CVE-2026-10698Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2026-10699Same product: Progress Moveit Transfer
CVE-2023-42656Same product: Progress Moveit Transfer
CVE-2023-36932Same product: Progress Moveit Transfer
CVE-2023-36934Same product: Progress Moveit Transfer
CVE-2023-6218Same product: Progress Moveit Transfer
CVE-2025-13147Same product: Progress Moveit Transfer
CVE-2023-6217Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
≤ 2025.0.7 · 2025.1.1 — 2025.1.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • IA-2 Identification and Authentication (Organizational Users)
  • SC-8 Transmission Confidentiality and Integrity
  • AC-17 Remote Access
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V10.4.16
  • V10.5.1
  • V11.4.3

Mitigating Controls (NIST 800-53 r5) AI

IA-2 Identification and Authentication (Organizational Users) good match
prevent

Enforces cryptographic or multi-factor identification and authentication of users before granting access, directly blocking spoofing-based authentication bypass in the MOVEit HTTPS module.

SC-8 Transmission Confidentiality and Integrity good match
prevent

Requires cryptographic protection of transmitted information, preventing spoofing attacks that rely on unauthenticated or tampered HTTPS sessions.

AC-17 Remote Access partial match
prevent

Mandates secure remote-access mechanisms and authentication for external connections, limiting the attack surface for spoofing attempts against MOVEit Transfer.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

PR.AA-03 mostly match
prevents

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

PR.AA-02 partial match
prevents

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
degrades

Secure authentication control directly mitigates authentication bypass by spoofing.

A.5.17 Authentication information mostly match
degrades

Authentication information management directly addresses credential handling that prevents spoofing.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect spoofing vulnerabilities but does not prevent them by itself.

A.5.15 Access control partial match
prevents

Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.

A.5.16 Identity management partial match
prevents

Identity management supports unique identities but does not guarantee resistance to spoofing.

A.5.18 Access rights partial match
prevents

Access rights assignment limits exposure but does not enforce authentication strength.

References