CVE-2026-8800: Progress MOVEit Transfer Authorization Flaw in Audit User Module

Technical summary

CVE-2026-8800 is an incorrect authorization vulnerability (CWE-863) in the Audit User module of Progress MOVEit Transfer. The flaw permits improper access control checks, enabling authenticated users with high privilege levels to read sensitive information beyond their intended authorization scope. The vulnerability affects MOVEit Transfer versions prior to 2025.0.7 and versions 2025.1.0 through 2025.1.2. The CVSS 3.1 score of 2.7 reflects low severity: network-accessible attack vector, low attack complexity, high privilege requirement, no user interaction, and confidentiality impact only (no integrity or availability compromise).

Business impact

The business risk is constrained. This vulnerability allows privileged insiders or compromised admin accounts to access audit data they are not entitled to view, potentially exposing sensitive operational or user information. However, since exploitation requires high-level credentials and yields read-only access, the exposure is limited compared to vulnerabilities that permit data modification, deletion, or service disruption. Organizations with strong access controls and minimal overprivileged accounts face further reduced risk.

Affected systems

Progress MOVEit Transfer installations are vulnerable if running versions before 2025.0.7 or versions 2025.1.0, 2025.1.1, or 2025.1.2. Version 2025.1.3 and 2025.0.7 and later are patched. Organizations should verify their installed version against the vendor's official release notes to confirm exposure.

Exploitability

Exploitation requires authentication with high-privilege credentials and direct network access to MOVEit Transfer. This is not a remote unauthenticated attack vector. An attacker must already possess elevated account privileges, which significantly limits real-world exploitation. The attack does not require user interaction or complex conditions. No public exploit code or active exploitation has been documented.

Remediation

Upgrade to MOVEit Transfer version 2025.0.7 or later, or to version 2025.1.3 or later if running the 2025.1.x branch. These versions contain the authorization fix. Organizations unable to patch immediately should restrict Audit User module access to only those administrators who have a documented business need and apply network-level restrictions to limit access to the MOVEit Transfer administrative interface.

Patch guidance

Consult Progress's official security advisory and release notes to confirm patch availability and deployment procedures for your specific environment. Test patches in a non-production environment first. Prioritize deployment to systems where high-privilege users regularly access the Audit User module, but do not deprioritize patching at the expense of other critical infrastructure.

Detection guidance

Monitor audit logs within MOVEit Transfer for unusual access patterns to the Audit User module, particularly by high-privilege accounts accessing audit records outside their normal job function. Review user permission assignments to ensure Audit User module access aligns with documented roles and responsibilities. Network-based detection should flag suspicious authentication events to the MOVEit Transfer management interface, especially from unexpected source IPs or at unusual times.

Why prioritize this

Although CVE-2026-8800 carries a low CVSS score, it should not be ignored. Prioritization depends on your organization's risk tolerance: systems with strict role-based access control and minimal over-privileged accounts can defer patching briefly, while those with excessive administrative privileges should patch sooner. The vulnerability is not in the CISA KEV catalog and has no known active exploitation, so other critical vulnerabilities should take immediate precedence. Schedule patching in your regular maintenance window within the next 30–60 days.

Risk score, explained

The CVSS 3.1 score of 2.7 (LOW) reflects a narrow attack profile: network-accessible but requires high-privilege authentication, low attack complexity, and confidentiality impact only. The absence of integrity or availability impact, combined with the prerequisite of elevated credentials, results in a low numeric score. However, this metric alone does not capture insider threat or credential compromise scenarios; context-specific risk assessment is essential.

Frequently asked questions