Multiple vulnerabilities in Progress MOVEit Transfer (July 10, 2026)
Multiple vulnerabilities have been discovered in Progress MOVEit Transfer. Some of them allow an attacker to cause privilege escalation, data confidentiality breaches, and remote indirect code injection (XSS).
CSIRTS triage
- What
- Multiple vulnerabilities in Progress MOVEit Transfer could allow privilege escalation, data confidentiality breaches, and remote indirect code injection.
- Who is affected
- Users of Progress MOVEit Transfer.
- Urgency
- Remediation is urgent due to the potential for significant security breaches.
- Action
- Install the latest security updates for Progress MOVEit Transfer.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch MOVEit Transfer
Get an email when a new MOVEit Transfer advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0856/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-119030.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
- Low exploitation riskCVE-2026-106990.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-106980.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-11903 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-10699 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-10698 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Progress Software MOVEit: Multiple vulnerabilitiescert-bund
- criticalProgress security advisory (AV26-678)cccs
- highCVE-2026-11903: Improper neutralization of input during web page generation ('cross-site scripting') vulnerabi…nvd
- highCVE-2026-10699: Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (…nvd
- highCVE-2026-10698: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVE…nvd
Recent advisories for Progress MOVEit Transfer
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- lowCVE-2026-8801: Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue a…nvd · 2026-07-08
- lowCVE-2026-8800: Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This iss…nvd · 2026-07-08
- lowCVE-2026-8651: Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS modu…nvd · 2026-07-08
- mediumCVE-2026-8650: Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This…nvd · 2026-07-08
- mediumCVE-2026-8649: Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEi…nvd · 2026-07-08
- highCVE-2026-11903: Improper neutralization of input during web page generation ('cross-site scripting') vulnerabi…nvd · 2026-07-08
More from CERT-FR Avis de sécurité
- unknownVulnerability in CPython (July 10, 2026)2026-07-10
- unknownMultiple vulnerabilities in Ubuntu Linux kernel (July 10, 2026)2026-07-10
- unknownVulnerability in NetApp ONTAP 9 (July 10, 2026)2026-07-10
- unknownMultiple vulnerabilities in Red Hat Linux kernel (July 10, 2026)2026-07-10
- unknownMultiple vulnerabilities in Suricata (July 10, 2026)2026-07-10