# CVE-2026-8651: Progress MOVEit Transfer authentication bypass by spoofing in HTTPS module

Source: https://junglewise.ai/threats/cve-2026-8651-progress-moveit-transfer-authentication-bypass-by-spoofing-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-8651 · Severity: low · CVSS 3.7 · Published 2026-07-08

Progress MOVEit Transfer, a managed file transfer solution used by organizations to securely share data, contains a security vulnerability in its HTTPS module. An attacker could potentially bypass certain authentication checks by spoofing identity information. While the impact is limited, it could allow unauthorized actions that compromise the integrity of the system's security controls.

Technologies: [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-8651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8651 being exploited in the wild.

**How severe is CVE-2026-8651?** Low severity, with a CVSS score of 3.7, published 8 July 2026.

**Which products and versions are affected?** Progress MOVEit Transfer before 2025.0.7, 2025.1.0 to 2025.1.3.

**Is there a fix for CVE-2026-8651?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8651 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8651?** Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Authentication Bypass by Spoofing (CWE-290) exists in the HTTPS module of Progress MOVEit Transfer. The flaw stems from improper IP resolution when accessing the machine interface, which could allow a remote attacker to bypass certain authentication or authorization checks by spoofing their identity. The attack complexity is considered high, as it likely requires specific environmental conditions or knowledge of the internal network structure to successfully spoof the expected identity. Progress has released patches in versions 2025.0.7 and 2025.1.3 to address this issue.

## Affected products

- Progress MOVEit Transfer before 2025.0.7, 2025.1.0 to 2025.1.3

## Timeline

- 2026-07-08: advisory
- 2026-07-08: disclosed

## References

- [https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html](https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html)

## Related threats

- [Progress MOVEit Transfer SFTP authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-89077-incorrect-implementation-of-authentication-algorithm)
- [Progress MOVEit Transfer SQL injection in Custom Reports](https://junglewise.ai/threats/cve-2026-89076-improper-neutralization-of-special-elements-used-in-an-sql)
- [Progress MOVEit Transfer insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-89075-insecure-storage-of-sensitive-information-vulnerability-in)
- [Progress MOVEit Transfer unicode encoding handling vulnerability](https://junglewise.ai/threats/cve-2026-89074-improper-handling-of-unicode-encoding-vulnerability-in-progress)
- [Progress MOVEit Transfer insufficient session expiration](https://junglewise.ai/threats/cve-2026-89073-insufficient-session-expiration-vulnerability-in-progress-moveit)