CVE-2026-10699: MOVEit Transfer Memory Leak Denial of Service

Technical summary

CVE-2026-10699 is a CWE-401 (Missing Release of Memory After Effective Lifetime) vulnerability in the Custom Reports functionality of Progress MOVEit Transfer. The affected versions are 2025.0.0 through 2025.0.7, 2025.1.0 through 2025.1.3, and 2026.0.0 before 2026.0.1. The vulnerability allows unauthenticated network-based exploitation, with no user interaction required. The CVSS 3.1 score of 7.5 reflects high availability impact; the attack vector is network-accessible and the complexity is low.

Business impact

MOVEit Transfer is commonly used for secure file transfer and data exchange in enterprise environments. A memory leak that leads to denial of service could disrupt critical file transfer workflows, impact business continuity, and prevent legitimate users from accessing the service. Organizations dependent on MOVEit for regulated data movement may face compliance and operational consequences during an outage.

Affected systems

Progress MOVEit Transfer versions 2025.0.0–2025.0.7, 2025.1.0–2025.1.3, and 2026.0.0 (before 2026.0.1) are vulnerable. Installations running the Custom Reports module are specifically at risk. Organizations should verify which versions are in production and cross-reference against the vulnerability advisory to confirm exact patch requirements.

Exploitability

The vulnerability is easily exploitable from the network without requiring authentication or user interaction. An attacker can remotely trigger the memory leak by interacting with the Custom Reports functionality. The low complexity and lack of prerequisites make this a practical attack vector for any adversary with network access to the MOVEit instance.

Remediation

Upgrade affected MOVEit Transfer instances to patched versions: 2025.0.8 or later for the 2025.0.x line, 2025.1.4 or later for the 2025.1.x line, and 2026.0.1 or later for the 2026.0.x line. Organizations should consult Progress's official advisory to confirm exact version availability and any procedural steps required during the upgrade. Verify patch application in a test environment before production deployment.

Patch guidance

Progress has released fixes for all affected branches. Organizations running 2025.0.x should upgrade to version 2025.0.8 or higher; those on 2025.1.x should move to 2025.1.4 or higher; and 2026.0.x deployments require 2026.0.1 or higher. Review the Progress MOVEit Transfer security advisory for any prerequisites, rollback procedures, or known issues associated with each release. Test patching in a non-production environment to ensure compatibility with your deployment.

Detection guidance

Monitor MOVEit Transfer process memory utilization and system resource consumption for unexpected growth patterns, particularly following interactions with the Custom Reports module. Check application logs for error messages related to memory allocation failures or service crashes. Network IDS/IPS rules targeting Custom Reports endpoints may help detect exploitation attempts. Establish baseline metrics for normal memory usage and alert on sustained anomalies that could indicate the memory leak being triggered.

Why prioritize this

This vulnerability merits immediate attention due to its network-accessible, unauthenticated exploitation path and direct impact on service availability. While not currently listed on the CISA KEV catalog, the ease of exploitation and the critical role MOVEit Transfer often plays in enterprise data workflows justify prioritizing patching within your standard change management process. Organizations should plan upgrades in their next maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), no user interaction (UI:N), and high impact on availability (A:H). Although confidentiality and integrity are not affected, the ability to remotely crash the service without authentication represents a significant operational risk. The score appropriately reflects the ease and impact of exploitation.

Frequently asked questions