CVE-2026-8651

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).

This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-865109.9A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message PaCVE-2026-865115.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString CVE-2026-865126.3A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply oCVE-2026-865135.3A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromCVE-2026-865146.3A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the componentCVE-2026-865154.3A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_entry of the file src/meta/txtp_parser.c oCVE-2026-865164.7A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deCVE-2026-865176.3A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/uCVE-2026-865186.3A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The maniCVE-2026-865195.3A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of CVE-2026-86528.5An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, CVE-2026-865207.5Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs
CVE-2026-8651: High severity, CVSS 7.5 | Vulnix