CVE-2026-8651: IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
Published Jul 8, 2026
·Updated
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Affected Software
3 affected components
Progress MOVEit Transfer<2025.0.7, >2025.1.0<2025.1.3
Progress MOVEit Transfer<2025.0.7
Progress MOVEit Transfer>=2025.1.1<2025.1.3
Event History
Jul 8, 2026
CVE Published
via MITRE·07:50 PM
Data Sourced
via MITRE·07:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-8651?
The severity of CVE-2026-8651 is rated as high with a score of 7.5.
2
How do I fix CVE-2026-8651?
To fix CVE-2026-8651, upgrade Progress MOVEit Transfer to version 2025.1.3 or later.
3
What type of vulnerability is CVE-2026-8651?
CVE-2026-8651 is a limited authentication bypass vulnerability caused by IPv6 loopback spoofing.
4
Which versions of MOVEit Transfer are affected by CVE-2026-8651?
CVE-2026-8651 affects Progress MOVEit Transfer versions before 2025.0.7 and from 2025.1.0 before 2025.1.3.
5
What does CVE-2026-8651 allow an attacker to do?
CVE-2026-8651 allows an attacker to bypass origin checks by spoofing the host header.