CVE-2026-8649: MOVEit Transfer Custom Reports Query Injection Vulnerability

Technical summary

CVE-2026-8649 is an improper neutralization of special elements in data query logic (CWE-943) affecting Progress MOVEit Transfer's Custom Reports functionality. The vulnerability exists in versions before 2025.0.7 and from 2025.1.0 before 2025.1.3. It allows an attacker with high-level privileges and user interaction to inject crafted input that bypasses query safeguards, potentially leading to unauthorized data access or manipulation. The CVSS 3.1 score of 6.4 reflects the requirement for high privileges and user interaction while acknowledging confidentiality, integrity, and availability impact.

Business impact

For organizations relying on MOVEit Transfer for secure file exchange, this vulnerability poses a risk to report data integrity and confidentiality. Since exploitation requires administrative credentials and user interaction, the primary concern is insider threats or compromised admin accounts. If exploited, attackers could exfiltrate sensitive files listed in reports, modify audit trails, or corrupt reporting functionality—impacting compliance documentation and forensic capabilities. Organizations should assess whether admin accounts have been compromised and whether sensitive data has been accessed via the Custom Reports module.

Affected systems

Progress MOVEit Transfer versions are affected as follows: all releases before 2025.0.7 in the 2025.0.x line, and releases from 2025.1.0 up to but not including 2025.1.3. Organizations should verify their current version against the vendor advisory to confirm exposure. The vulnerability is specific to the Custom Reports module and does not affect core file transfer functionality in other components.

Exploitability

Exploitation requires an authenticated attacker with high-level administrative privileges and user interaction—meaning an admin must be socially engineered, compromised, or acting maliciously. The network-accessible nature and moderate CVSS score indicate this is not a trivial remote code execution; rather, it is a privilege-escalation or data-manipulation risk limited to the admin tier. The high barrier to entry (privilege + interaction) keeps this from being actively exploited in the wild against secured deployments, though organizations with weak credential hygiene face elevated risk.

Remediation

Upgrade MOVEit Transfer to version 2025.0.7 or later (for the 2025.0.x branch) or to version 2025.1.3 or later (for the 2025.1.x branch). Verify the upgrade with the Progress vendor advisory to confirm patch application. As an interim measure, restrict access to the Custom Reports module to trusted administrators only, review admin account usage logs for suspicious query patterns, and enforce multi-factor authentication on all administrative accounts.

Patch guidance

Progress has released patched versions to address this vulnerability. Organizations on 2025.0.x should upgrade to 2025.0.7 or later; those on 2025.1.x should upgrade to 2025.1.3 or later. Consult the Progress MOVEit Transfer release notes and security advisory for exact patch availability and any compatibility notes. Test patches in a non-production environment before deployment to ensure no disruption to file transfer workflows or reporting functionality.

Detection guidance

Monitor MOVEit Transfer logs for unusual Custom Reports activity, particularly: queries with special characters or escape sequences, administrative users accessing reports outside normal business hours, rapid or bulk report generation attempts, and failed report execution attempts followed by successful ones. Audit admin account access logs and review which users have modified report definitions or queries. Tools like SIEM integration with MOVEit logs can alert on suspicious patterns. Compare audit trails against known administrative activities to identify anomalies.

Why prioritize this

While the CVSS score is moderate (6.4), this vulnerability affects a critical infrastructure component used for secure file exchange. The requirement for administrative privileges and user interaction lowers the attack surface compared to unauthenticated flaws, but organizations with weak password hygiene, shared admin accounts, or high insider-threat risk should prioritize patching. The integrity and confidentiality impact on reports—which often contain audit trails and compliance records—elevates business priority even at moderate technical risk.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a medium-severity vulnerability because: (1) network-accessible attack vector increases exposure; (2) high privilege requirement and required user interaction significantly reduce likelihood; (3) impact is high across confidentiality, integrity, and availability if an attacker succeeds; (4) scope is unchanged (no privilege boundary crossing to other systems). The score appropriately balances the serious potential impact against the high barriers to exploitation.

Frequently asked questions