This vulnerability (CVE-2026-8649) in Progress MOVEit Transfer arises from improper neutralization of special elements in data query logic within the Custom Reports modules. It affects versions prior to 2026.0.0, 2025.1.3, and 2025.0.7. The weakness corresponds to CWE-943 and could allow an attacker with high privileges and user interaction to cause significant confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 6.4, with attack vector network, high attack complexity, high privileges required, and user interaction needed. The vendor has not yet provided an official fix or remediation level, and no exploits are known in the wild at this time.

Successful exploitation could result in high impact on confidentiality, integrity, and availability of the affected MOVEit Transfer system. The vulnerability requires network access, high privileges, and user interaction, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected MOVEit Transfer versions and monitor for unusual activity. Follow vendor updates closely for any forthcoming patches or mitigations.