CVE-2026-8650: Progress MOVEit Transfer Path Traversal Vulnerability in Admin Settings

Technical summary

CVE-2026-8650 is a relative path traversal vulnerability (CWE-23) affecting the Admin Settings module of Progress MOVEit Transfer. The vulnerability allows an authenticated administrator to construct specially crafted relative paths to read arbitrary files outside the intended directory. With a CVSS 3.1 score of 4.5 (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), exploitation requires adjacent network access, high administrative privileges, and no user interaction, but results in high confidentiality impact with no integrity or availability compromise. Affected versions are MOVEit Transfer before 2025.0.7 and all 2025.1.x versions before 2025.1.3.

Business impact

An attacker with administrative credentials could exfiltrate sensitive configuration files, database credentials, encryption keys, or other confidential data stored on the MOVEit server. This could compromise the security of file transfer operations, enable lateral movement within the network, or expose customer data if MOVEit is used in a managed service context. The damage depends on the sensitivity of files accessible through the vulnerability and the attacker's subsequent actions.

Affected systems

Progress MOVEit Transfer installations are affected if running versions before 2025.0.7 or any 2025.1.x version before 2025.1.3. Organizations should verify their current MOVEit Transfer version immediately. Both maintenance release (2025.0.x) and feature release (2025.1.x) tracks contain vulnerable versions, requiring patch updates across different version lines.

Exploitability

Exploitation requires valid administrator credentials and network access to the MOVEit admin interface—a high barrier for external attackers. However, the vulnerability is trivial to exploit once an attacker has legitimate admin access, requiring only crafted input to the vulnerable Admin Settings module. The CVSS score reflects this trade-off: significant capability impact offset by restrictive preconditions. Insider threats or compromised admin accounts pose the primary risk.

Remediation

Update MOVEit Transfer to version 2025.0.7 or later for the maintenance track, or to version 2025.1.3 or later for the 2025.1 feature track. Verify the installed version in the MOVEit admin console and apply the appropriate patch. After patching, conduct file access logs review to identify any unauthorized administrative activity on vulnerable instances.

Patch guidance

Progress has released patches addressing this vulnerability. Administrators on the 2025.0.x branch should upgrade to 2025.0.7 or later; those on the 2025.1.x branch should upgrade to 2025.1.3 or later. Verify your current version in the MOVEit Transfer admin interface under System Settings or check the version information in installation logs. Plan patching during a maintenance window to minimize service disruption, and test patches in a non-production environment first to ensure compatibility with existing file transfer workflows.

Detection guidance

Monitor MOVEit Transfer Admin Settings module access logs for suspicious relative path constructs (sequences like '../', '..\', or URL-encoded variants) in requests. Examine file access audit logs for unexpected reads of system configuration files, credential stores, or encryption key repositories. Review administrator activity logs for unusual patterns or timing. Deploy file integrity monitoring on critical MOVEit configuration and data directories to detect unauthorized access attempts. Organizations without detailed logging may benefit from enabling verbose audit logging before and after patching to establish a baseline and verify security improvements.

Why prioritize this

This vulnerability merits prompt but measured attention. The MEDIUM severity reflects realistic constraints—admin-level access is required, and the impact is read-only. However, the confidentiality impact is high, and compromised admin credentials are a realistic threat in many environments. Organizations with strong admin credential controls and limited admin exposure can defer patching slightly, but those with elevated insider risk or in regulated industries should prioritize updates. The vulnerability does not appear on CISA's KEV catalog, indicating no active exploitation in the wild as of the advisory date.

Risk score, explained

The CVSS 3.1 score of 4.5 (MEDIUM) reflects: (1) high confidentiality impact—an attacker can read sensitive files; (2) high privilege requirement—only admins can exploit this; (3) adjacent network access, not remote; (4) no integrity or availability impact; (5) no user interaction needed. The score appropriately positions this as a concerning but contained risk for organizations with rigorous admin access controls, and a more serious risk for those with weak credential hygiene or high insider threat profiles.

Frequently asked questions