Cyber Resilience

CVE-2026-8801

Progress Moveit Transfer ≤ 2025.0.8

Published
08 July 2026
Modified
09 July 2026
CVSS Score v3.1 3.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0034 27th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-8801 is a low-severity Trailing Space (CWE-46) vulnerability in Progress Moveit Transfer. Its CVSS base score is 3.5 (Low).

Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

CWE(s)
CWE-46

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1105 Ingress Tool Transfer Command And Controlconfidence: HIGH
Path equivalence flaw in the file upload module allows an attacker to upload arbitrary files to the server, directly enabling ingress tool transfer.
attack.mitre.org →
T1505.003 Web Shell Persistenceconfidence: MEDIUM
Uploaded files could be placed in web-accessible directories, facilitating deployment of a web shell for persistent remote access.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-10699Same product: Progress Moveit Transfer
CVE-2024-2291Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2025-2324Same product: Progress Moveit Transfer
CVE-2023-36933Same product: Progress Moveit Transfer
CVE-2023-6217Same product: Progress Moveit Transfer
CVE-2026-10698Same product: Progress Moveit Transfer
CVE-2024-0396Same product: Progress Moveit Transfer
CVE-2023-35036Same product: Progress Moveit Transfer
CVE-2023-42660Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
≤ 2025.0.8 · 2025.1.0 — 2025.1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces strict access-control decisions on file-upload paths, blocking requests that exploit path-equivalence to bypass intended restrictions.

SI-10 Information Input Validation good match
prevent

Validates and normalizes all file-upload input paths, rejecting or canonicalizing equivalent representations that could lead to unauthorized access.

CM-7 Least Functionality partial match
prevent

Restricts MOVEit Transfer to only the minimal set of upload-related functions and modules, reducing the attack surface for path-manipulation flaws.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation that prevents path-equivalence flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect path-equivalence flaws before deployment.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate input validation for path names, reducing trailing-space equivalence issues.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles include canonicalization and path-handling controls that mitigate ambiguous file names.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly require stripping or rejecting trailing spaces in file paths, addressing the root cause.

References