CVE-2026-8650

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

VendorProductVersions
ProgressMOVEit Transfer>= 2025.1.0, < 2025.1.3; < 2025.0.7

References

Timeline

Published
Jul 8, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-865005.5In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project AdmCVE-2026-865012.8In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logCVE-2026-865028.4In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote DeCVE-2026-865033.3In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingCVE-2026-865047.8In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executCVE-2026-865053.3In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplaceCVE-2026-865065.9In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling dataCVE-2026-865076.1Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can eCVE-2026-865099.6A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the coCVE-2026-86517.5Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: befCVE-2026-865109.9A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message PaCVE-2026-865115.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString
CVE-2026-8650: High severity, CVSS 7.5 | Vulnix