Is CVE-2026-8801 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8801 being exploited in the wild.

How severe is CVE-2026-8801?

Low severity, with a CVSS score of 3.5, published 8 July 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.0.8, 2025.1.0 before 2025.1.4.

Is there a fix for CVE-2026-8801?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8801 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8801?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8801: Progress MOVEit Transfer path equivalence in File Upload modules

CVE-2026-8801 · Severity: low · CVSS 3.5 · Published 2026-07-08

Progress MOVEit Transfer, a managed file transfer solution used by organizations to securely share data, contains a vulnerability in its file upload module. An attacker with basic user permissions could potentially bypass security rules that restrict which types of files are allowed to be uploaded. This could lead to the storage of unauthorized or prohibited file types on the corporate server.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-8801 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8801 being exploited in the wild.
How severe is CVE-2026-8801?: Low severity, with a CVSS score of 3.5, published 8 July 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.0.8, 2025.1.0 before 2025.1.4.
Is there a fix for CVE-2026-8801?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8801 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8801?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path equivalence vulnerability (CWE-46) exists in the File Upload modules of Progress MOVEit Transfer. The flaw stems from improper handling of filenames, specifically involving trailing spaces or similar path equivalence techniques, which can be used to bypass configured file extension restrictions. An attacker with low-privileged network access and minimal user interaction could exploit this to upload prohibited file types. The issue is resolved in versions 2025.0.8 and 2025.1.4.

Affected products

Progress MOVEit Transfer before 2025.0.8, 2025.1.0 before 2025.1.4

Timeline

2026-07-08: disclosed
2026-07-08: advisory

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.