This vulnerability (CVE-2026-8800) in Progress MOVEit Transfer involves incorrect authorization in the Audit User module, allowing potentially unauthorized actions due to improper access control. The affected versions include all versions before 2025.0.7 and versions from 2025.1.0 before 2025.1.3. The CVSS 3.1 base score is 2.7, indicating low severity with network attack vector, low complexity, and requiring high privileges but no user interaction. No vendor advisory or patch information is currently available to confirm remediation status.

The impact is limited to low confidentiality loss without integrity or availability impact, given the CVSS vector (C:L/I:N/A:N). The vulnerability requires high privileges to exploit and does not involve user interaction, which reduces the likelihood of exploitation. There are no known exploits in the wild, indicating limited current risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review and restrict access to the Audit User module to trusted administrators only, minimizing exposure to this vulnerability.