CVE-2026-8801

LowCVSS 3.5

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Path equivalence vulnerability in the File Upload module of Progress MOVEit Transfer allows potential security bypass. Affects versions before 2025.0.8 and from 2025.1.0 before 2025.1.4.

Risk Assessment

An attacker could exploit this flaw to gain unauthorized access to files or perform operations outside allowed paths, potentially leading to data leakage or system integrity compromise.

Recommendation

Immediately upgrade MOVEit Transfer to version 2025.0.8 or later (for 2025.0 branch) or to version 2025.1.4 or later (for 2025.1 branch).

Original NVD description (English source)

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.