Progress Moveit Transfer — CVE-2026-8649 (Critical)

Date Jul 8, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Progress · Moveit Transfer

CVE CVE-2026-8649

Critical vendor advisory CVE-2026-8649

Summary

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 6.4) in Progress Moveit Transfer. Patch or mitigate promptly. EPSS percentile: 13%.

Operator check

Review CVE-2026-8649 in your asset inventory. Apply patches per vendor guidance and verify Moveit Transfer is not exposed. CVSS score: 6.4. EPSS probability: 0.2%; percentile: 13%.

Sources

NVD — CVE-2026-8649 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed