First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-8801

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).

This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Progress	MOVEit Transfer	>= 2025.1.0, < 2025.1.4; < 2025.0.8

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.htmlRelease Notes

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-880105.3Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.g CVE-2026-880118.1Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he CVE-2026-880125.3Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo CVE-2026-880135.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the CVE-2026-880146.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the CVE-2026-880155.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local CVE-2026-880167.1rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/CVE-2026-880177.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the CVE-2026-880189.8rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve CVE-2026-88024.3A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file CVE-2026-880206.1Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interfa CVE-2026-880217.1Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a desti

CVE-2026-8801: Critical severity, CVSS 9.8 | Vulnix