Is CVE-2026-8650 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8650 being exploited in the wild.

How severe is CVE-2026-8650?

Medium severity, with a CVSS score of 4.5, published 8 July 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.0.7, 2025.1.0 before 2025.1.3.

Is there a fix for CVE-2026-8650?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8650 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-8650?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8650: Progress MOVEit Transfer relative path traversal in Admin Settings

CVE-2026-8650 · Severity: medium · CVSS 4.5 · Published 2026-07-08

Progress MOVEit Transfer is a secure managed file transfer solution used by organizations to share sensitive data. A vulnerability in the administrative settings module could allow an authorized administrator to access files on the underlying system that they should not be able to see. This could lead to the exposure of sensitive configuration files or system data, potentially compromising the security of the server.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-8650 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8650 being exploited in the wild.
How severe is CVE-2026-8650?: Medium severity, with a CVSS score of 4.5, published 8 July 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.0.7, 2025.1.0 before 2025.1.3.
Is there a fix for CVE-2026-8650?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8650 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-8650?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A relative path traversal vulnerability (CWE-23) exists in the Admin Settings module of Progress MOVEit Transfer. The flaw stems from insufficient validation of user-supplied paths, allowing an attacker with high-level administrative privileges (PR:H) to navigate outside of the intended directory structure. By exploiting this, an authenticated administrator can read arbitrary files on the host operating system. The attack vector is restricted to the adjacent network (AV:A). The issue has been addressed in MOVEit Transfer versions 2025.0.7 and 2025.1.3.

Affected products

Progress MOVEit Transfer before 2025.0.7, 2025.1.0 before 2025.1.3

Timeline

2026-07-08: disclosed
2026-07-08: advisory

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.