AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-8649

Improper Neutralization of Special Elements in Data Query Logic vulnerability...

Progress Software

CVE-2026-8649 · Published Jul 8, 2026 · updated Jul 10, 2026

Medium6.4
Fix: upgrade to 2025.1.3 or later (2 fixed versions below)
Progress Software advisory

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Affected versions

PackageAffectedFixed in
MOVEit Transfer
Product
>= 2025.1.0, < 2025.1.32025.1.3
< 2025.0.72025.0.7
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-943

More Progress Software advisories

All Progress Software
Low 3.5Jul 8Path equivalence: vulnerability in Progress MOVEit TransferCVE-2026-8801fixed in 2025.1.4 +1Medium 4.5Jul 8Progress Software MOVEit Transfer: path traversalCVE-2026-8650fixed in 2025.1.3 +1Low 3.7Jul 8Progress Software MOVEit Transfer: authentication bypassCVE-2026-8651fixed in 2025.1.3 +1Low 2.7Jul 8Progress Software MOVEit Transfer: improper authorizationCVE-2026-8800fixed in 2025.1.3 +1High 7.2Jul 8Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-10698fixed in 2025.0.8 +2High 7.5Jul 8Progress Software MOVEit Transfer: memory leakCVE-2026-10699fixed in 2025.0.8 +2