CVE-2026-8649 is an injection flaw in the Custom Reports modules of Progress MOVEit Transfer (CVSS 6.4, medium). It affects versions before 2025.0.7 and 2025.1.0 before 2025.1.3. Update to a fixed release. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says MOVEit Transfer before 2025.0.7, and from 2025.1.0 before 2025.1.3, is affected. The weakness is CWE-943, improper neutralization of special elements in data query logic. The vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, so it needs a privileged user and user interaction.
The Progress 2026 release notes list the issue as fixed scoping of custom report results. The record implies fixes in 2025.0.7 and 2025.1.3, and the 2026 release carries it, but confirm against the Progress advisory. The record is not in the CISA KEV catalog.
How to check if you're exposed
Sign in to the MOVEit Transfer admin interface and read the version in the about information. Compare it with the ranges above. Then check whether Custom Reports is used and who holds the rights to create or edit reports.
What to do now
- Upgrade to 2025.0.7, 2025.1.3 or a current 2026 release.
- Limit the accounts that can create or edit custom reports.
- Review existing custom reports for unusual definitions.
- Keep the MOVEit management interface off the internet where possible.
- Follow Progress release notes for later changes.
Why it matters
Injection into a query layer happens when user supplied parts of a report definition are treated as logic. The scores are modest here because the attacker needs a privileged account and a user to act.
MOVEit is a file transfer product, so its data is attractive, and past incidents in this product class make fast patching the safer habit.
Quick check
Why is the score only 6.4?
The vector requires a high privilege account and user interaction, which lowers the base score.
Sources
Last reviewed: 19 October 2026.
