CVE-2026-10698: MOVEit Transfer Custom Reports SQL Injection

Technical summary

CVE-2026-10698 is classified as an Improper Neutralization of Special Elements in Data Query Logic (CWE-943). The vulnerability exists in Progress MOVEit Transfer's Custom Reports functionality, allowing authenticated administrators to inject specially crafted inputs into report query logic. This can bypass intended data access controls within the application. The vulnerability requires high privilege level access (PR:H) and affects MOVEit Transfer versions 2025.0.0 through 2025.0.7, 2025.1.0 through 2025.1.3, and 2026.0.0 before 2026.0.1. No user interaction is required once an attacker has administrative credentials.

Business impact

Organizations using MOVEit Transfer may face unauthorized data exposure if administrator accounts are compromised or if malicious insiders exploit this vulnerability. Since Custom Reports are often used to aggregate sensitive business data, successful exploitation could lead to disclosure of confidential information, regulatory compliance violations, and reputational damage. The impact is limited to data confidentiality and integrity within the MOVEit Transfer environment itself, as the vulnerability does not affect system availability or enable lateral movement outside the application.

Affected systems

Progress MOVEit Transfer customers running versions 2025.0.0 to 2025.0.7, 2025.1.0 to 2025.1.3, or 2026.0.0 are affected. Organizations should verify their current MOVEit Transfer version in the system console or administrative settings. The vulnerability only impacts the Custom Reports module, so it does not affect MOVEit Transfer deployments that do not use this feature, though most enterprise deployments include it as a standard component.

Exploitability

While the CVSS score of 7.2 reflects high severity, exploitation requires administrative credentials and cannot be triggered remotely by unauthenticated users. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed public exploit activity as of the vulnerability disclosure. However, the attack vector is network-accessible (AV:N) and the attack complexity is low (AC:L), meaning that any compromised administrator account or insider threat can trivially exploit this vulnerability. Organizations with strong access controls, privileged access management (PAM), and admin account monitoring should consider this a moderate operational risk.

Remediation

Progress has released patched versions for all affected release branches. Organizations must upgrade MOVEit Transfer to verified patched versions: verify against the vendor advisory for the exact patch versions for your release branch (2025.0, 2025.1, or 2026.0). After patching, test the Custom Reports module functionality in a non-production environment to ensure business continuity. Additionally, review administrator account access logs for the past 30 days to identify any suspicious report query activity or data exports that may indicate prior exploitation.

Patch guidance

Apply the latest available security patch from Progress for your MOVEit Transfer version branch. Coordinate the patch deployment with your change management process, as MOVEit Transfer often runs in mission-critical file transfer environments. Test patch compatibility with any custom report definitions or integrations before deploying to production. Verify against Progress's official security advisory for the specific patch version numbers and any known issues or rollback procedures. If you cannot patch immediately, restrict Custom Reports access to only essential administrative users and implement enhanced monitoring on report queries and exports.

Detection guidance

Monitor MOVEit Transfer audit logs for suspicious Custom Reports activity, including: creation or modification of reports by unfamiliar administrators, reports accessing data outside typical scope, and unusually large data exports from reports. Review database query logs if available for evidence of injected query syntax. Search for filenames, export paths, or timestamps that correlate with suspicious user sessions. Implement alerts on administrator login events and privilege escalation attempts within MOVEit Transfer. If your environment has network detection capabilities, monitor for unusual outbound data transfers initiated from the MOVEit Transfer application server immediately after report execution.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS 7.2 score and data confidentiality/integrity impact classify it as high priority. However, the requirement for administrative credentials significantly reduces real-world risk for organizations with proper access controls. Prioritize patching if you have: high-privilege user account compromise risks, regulatory requirements for timely patching of data-access vulnerabilities, or if Custom Reports are used to expose regulated data (PII, health records, financial data). Organizations with mature PAM and audit controls can schedule patching in their next maintenance window, while those with weak admin account hygiene should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the combination of network-accessible exploitation, high-privilege requirement, and impact across confidentiality, integrity, and availability metrics. The score appropriately captures that an authenticated attacker can read and modify data within the application scope. The score does not account for the privilege requirement as a significant mitigating factor in the real-world risk posture of well-managed environments; organizations with strong access controls may reasonably assess their actual risk as lower than the numerical score suggests. The vulnerability does not qualify for CVSS modifiers related to environmental factors, but your specific risk may vary based on the sensitivity of data accessible through Custom Reports.

Frequently asked questions