CVE-2026-8649: Institution scope bypass vulnerability in custom reports
Published Jul 8, 2026
·Updated
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Affected Software
3 affected components
Progress MOVEit Transfer<2025.0.7, >=2025.1.0<2025.1.3
Progress MOVEit Transfer<2025.0.7
Progress MOVEit Transfer>=2025.1.0<2025.1.3
Event History
Jul 8, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Sep 6, 58495
Event
via FIRST·04:35 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-8649?
The severity of CVE-2026-8649 is medium with a score of 6.4.
2
How do I fix CVE-2026-8649?
To fix CVE-2026-8649, upgrade to Progress MOVEit Transfer version 2026.0.0 or later.
3
What is the risk associated with CVE-2026-8649?
CVE-2026-8649 has a risk rating of 57, indicating a moderate level of risk.
4
What software is affected by CVE-2026-8649?
CVE-2026-8649 affects the Progress MOVEit Transfer software, specifically the Custom Reports modules in versions prior to 2026.0.0, 2025.1.3, and 2025.0.7.
5
What type of vulnerability is CVE-2026-8649?
CVE-2026-8649 is categorized as an improper neutralization of special elements in data query logic vulnerability.