CVE-2026-10698

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer:2026.0.0:::::::*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales en la Lógica de Consulta de Datos en Progress MOVEit Transfer (módulos de Informes Personalizados). Este problema afecta a MOVEit Transfer: desde 2025.0.0 anterior a 2025.0.8, desde 2025.1.0 anterior a 2025.1.4, desde 2026.0.0 anterior a 2026.0.1.

Information

Published : 2026-07-08 15:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-10698

Mitre link : CVE-2026-10698

CVE.ORG link : CVE-2026-10698

JSON object : View

Products Affected

progress

moveit_transfer

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-10698", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10698", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress", "modules": ["Custom Reports"], "product": "MOVEit Transfer", "versions": [{"status": "affected", "version": "2025.0.0", "lessThan": "2025.0.8", "versionType": "semver"}, {"status": "affected", "version": "2025.1.0", "lessThan": "2025.1.4", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-08T15:16:25.040", "references": [{"url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).\n\nThis issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Elementos Especiales en la L\u00f3gica de Consulta de Datos en Progress MOVEit Transfer (m\u00f3dulos de Informes Personalizados).\n\nEste problema afecta a MOVEit Transfer: desde 2025.0.0 anterior a 2025.0.8, desde 2025.1.0 anterior a 2025.1.4, desde 2026.0.0 anterior a 2026.0.1."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70852202-7FC7-408A-8205-3AAA494EE3DD", "versionEndIncluding": "2024.1.8"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26DA4DA6-DF46-478A-A880-42549D8E6F6C", "versionEndExcluding": "2025.0.8", "versionStartIncluding": "2025.0.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81C2C6E0-529A-4414-9266-15992A9749B5", "versionEndExcluding": "2025.1.4", "versionStartIncluding": "2025.1.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:2026.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FBC74C0-6E1F-4CEC-B913-A7D0FE6D61B1"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}