CVE-2026-8649CWE-943

Institution scope bypass vulnerability in custom reports

Medium · published July 8, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.1th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-07-08T19:41Z
EPSS history
Timeline
  • 08 JUL 19:41Z
    Institution scope bypass vulnerability in custom reports
    cvelistv5