CVE-2026-8651

LowCVSS 3.7

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Limited authentication bypass by spoofing vulnerability in the HTTPS module of Progress MOVEit Transfer. Affects versions before 2025.0.7 and from 2025.1.0 before 2025.1.3.

Risk Assessment

An attacker may impersonate another user, potentially leading to unauthorized access to data transferred through MOVEit Transfer.

Recommendation

Immediately upgrade MOVEit Transfer to version 2025.0.7 or later (for the 2025.0 branch) or to version 2025.1.3 or later (for the 2025.1 branch).

Original NVD description (English source)

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.