CVE-2026-10699

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer::::::::
	cpe:2.3:a:progress:moveit_transfer:2026.0.0:::::::*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad por ausencia de liberación de memoria después de la vida útil efectiva en Progress MOVEit Transfer (módulos de Informes Personalizados). Este problema afecta a MOVEit Transfer: desde 2025.0.0 antes de 2025.0.8, desde 2025.1.0 antes de 2025.1.4, desde 2026.0.0 antes de 2026.0.1.

Information

Published : 2026-07-08 15:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-10699

Mitre link : CVE-2026-10699

CVE.ORG link : CVE-2026-10699

JSON object : View

Products Affected

progress

moveit_transfer

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-10699", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10699", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T15:09:02.289312Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress", "modules": ["Custom Reports"], "product": "MOVEit Transfer", "versions": [{"status": "affected", "version": "2025.0.0", "lessThan": "2025.0.8", "versionType": "semver"}, {"status": "affected", "version": "2025.1.0", "lessThan": "2025.1.4", "versionType": "semver"}, {"status": "affected", "version": "2026.0.0", "lessThan": "2026.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-08T15:16:25.173", "references": [{"url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).\n\nThis issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de liberaci\u00f3n de memoria despu\u00e9s de la vida \u00fatil efectiva en Progress MOVEit Transfer (m\u00f3dulos de Informes Personalizados).\n\nEste problema afecta a MOVEit Transfer: desde 2025.0.0 antes de 2025.0.8, desde 2025.1.0 antes de 2025.1.4, desde 2026.0.0 antes de 2026.0.1."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70852202-7FC7-408A-8205-3AAA494EE3DD", "versionEndIncluding": "2024.1.8"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26DA4DA6-DF46-478A-A880-42549D8E6F6C", "versionEndExcluding": "2025.0.8", "versionStartIncluding": "2025.0.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81C2C6E0-529A-4414-9266-15992A9749B5", "versionEndExcluding": "2025.1.4", "versionStartIncluding": "2025.1.0"}, {"criteria": "cpe:2.3:a:progress:moveit_transfer:2026.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FBC74C0-6E1F-4CEC-B913-A7D0FE6D61B1"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}