This vulnerability (CVE-2026-8651) in Progress MOVEit Transfer involves a limited authentication bypass via spoofing in the HTTPS module. It affects MOVEit Transfer versions prior to 2025.0.7 and versions starting from 2025.1.0 up to but excluding 2025.1.3. The CVSS v3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on integrity only. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to bypass authentication mechanisms by spoofing, potentially leading to limited unauthorized actions affecting data integrity. There is no impact on confidentiality or availability. The low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. No specific mitigations are currently recommended by the vendor.