AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-10699

Progress Software MOVEit Transfer: memory leak

Progress Software

CVE-2026-10699 · Published Jul 8, 2026 · updated Jul 10, 2026

High7.5
Fix: upgrade to 2025.0.8 or later (3 fixed versions below)
Progress Software advisory

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

Affected versions

PackageAffectedFixed in
MOVEit Transfer
Product
>= 2025.0.0, < 2025.0.82025.0.8
>= 2025.1.0, < 2025.1.42025.1.4
>= 2026.0.0, < 2026.0.12026.0.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-401

More Progress Software advisories

All Progress Software
Low 3.5Jul 8Path equivalence: vulnerability in Progress MOVEit TransferCVE-2026-8801fixed in 2025.1.4 +1Medium 6.4Jul 8Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-8649fixed in 2025.1.3 +1Medium 4.5Jul 8Progress Software MOVEit Transfer: path traversalCVE-2026-8650fixed in 2025.1.3 +1Low 3.7Jul 8Progress Software MOVEit Transfer: authentication bypassCVE-2026-8651fixed in 2025.1.3 +1Low 2.7Jul 8Progress Software MOVEit Transfer: improper authorizationCVE-2026-8800fixed in 2025.1.3 +1High 7.2Jul 8Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-10698fixed in 2025.0.8 +2