This vulnerability (CVE-2026-10698) in Progress MOVEit Transfer's Custom Reports modules is classified as CWE-943, indicating improper neutralization of special elements in data query logic. This flaw allows an attacker with high privileges to potentially manipulate queries, resulting in high impact on confidentiality, integrity, and availability. The affected versions are 2025.0.0, 2025.1.0, and 2026.0.0, with fixes introduced in later versions (2025.0.8, 2025.1.4, and 2026.0.1 respectively). There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

The vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected MOVEit Transfer system due to improper handling of special elements in data queries. This could allow attackers with high privileges to execute unauthorized data queries or manipulate data, severely impacting the system's security and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Progress's advisories for updates and consider restricting access to the affected modules to trusted administrators until a patch is available.