CVE-2026-8651: Limited Authentication Bypass in Progress MOVEit Transfer HTTPS Module

Technical summary

CVE-2026-8651 is an authentication bypass vulnerability stemming from improper validation of HTTPS authentication credentials (CWE-290: Improper Input Validation). The vulnerability resides in MOVEit Transfer's HTTPS module and permits limited spoofing of legitimate authentication. The CVSS 3.1 score of 3.7 (LOW severity) reflects the high complexity required to exploit the flaw (AC:H), the lack of confidentiality impact (C:N), and the limited integrity impact (I:L). An attacker must already have network access and overcome significant technical barriers to successfully exploit this issue. The vulnerability does not enable denial of service or system takeover.

Business impact

The integrity-focused nature of this vulnerability means attackers could potentially modify or tamper with files in transit through MOVEit Transfer without proper authorization, compromising data accuracy and compliance posture. For organizations relying on MOVEit Transfer for secure file exchange with partners, this creates a narrow but real risk window. The low CVSS score and high exploitation complexity mean this is not an immediate crisis, but it does warrant timely remediation to prevent data integrity incidents and maintain end-to-end trust in file transfer workflows.

Affected systems

Progress MOVEit Transfer versions before 2025.0.7 and versions 2025.1.0 through 2025.1.2 are affected. Organizations should verify their current MOVEit Transfer version in their deployment environment and cross-reference against these version ranges. The vulnerability is specific to the HTTPS module, so all deployments using HTTPS for file transfer are potentially in scope if running a vulnerable version.

Exploitability

Exploitation requires network access to a MOVEit Transfer instance and high technical complexity to craft a successful spoofing attack against the HTTPS authentication mechanism. The CVSS vector (AC:H) indicates that specific, non-standard conditions must be present for the attack to succeed. There is no evidence of widespread exploitation, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active, organized attack campaigns have materialized. Nonetheless, determined threat actors with specific knowledge of MOVEit Transfer deployments could potentially attempt exploitation.

Remediation

Progress has issued patched versions that resolve this authentication bypass. Organizations should upgrade MOVEit Transfer to version 2025.0.7 or later (if on the 2025.0.x branch) or to version 2025.1.3 or later (if on the 2025.1.x branch). Verify patch availability through Progress's official security advisories and test patches in a non-production environment before broad deployment to ensure compatibility with existing integrations and workflows.

Patch guidance

1. Identify your current MOVEit Transfer version using your deployment documentation or the administrative interface. 2. Consult Progress's official security advisory to confirm patch version availability for your release track. 3. Download patches exclusively from Progress's official portal or trusted vendor channels. 4. Test the patched version in a staging environment that mirrors production configuration, including HTTPS settings and file transfer workflows. 5. Schedule maintenance windows to deploy patches to production systems, prioritizing critical business continuity paths. 6. After patching, verify that HTTPS authentication functions normally and that no file transfer operations are degraded. 7. Document patch application and date for compliance and audit purposes.

Detection guidance

Monitor MOVEit Transfer logs for unusual HTTPS authentication failures or anomalous authentication patterns that deviate from baseline behavior. Inspect HTTPS handshake logs and TLS session records for signs of certificate or credential spoofing attempts. Deploy network segmentation to limit which systems can reach MOVEit Transfer HTTPS endpoints. Use file integrity monitoring (FIM) on files transferred through MOVEit to detect unauthorized modifications that may indicate a successful authentication bypass. Enable enhanced logging in MOVEit Transfer's HTTPS module if available, and correlate logs with network-based TLS inspection tools to identify anomalies.

Why prioritize this

This vulnerability merits timely but not emergency-level prioritization. The LOW CVSS score (3.7) and high exploitation complexity reflect a genuine but narrow attack surface. The absence of KEV listing and lack of active exploitation reduce immediate urgency. However, the integrity-focused impact means that successful exploitation could silently compromise data accuracy, making it valuable to patch within a standard maintenance window rather than deferring indefinitely. Organizations with strict data integrity requirements or regulatory mandates around file transfer security should move this up in their patch queue.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW) is driven by: (1) high attack complexity (AC:H), reflecting the technical barriers and specific conditions needed to exploit the flaw; (2) no confidentiality impact, meaning attackers cannot read protected data; (3) limited integrity impact (I:L) restricted to spoofing scope; (4) no availability impact; (5) unchanged scope (S:U) meaning the attack does not cross privilege boundaries or affect other systems. This score appropriately reflects a vulnerability that is real but operationally constrained, making it a 'fix when convenient' rather than 'fix immediately' priority for most organizations.

Frequently asked questions