CVE-2026-10698: Table scope bypass vulnerability in custom reports

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-25
Weakness: CWE-943

Description

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

Affected products

Progress MOVEit Transfer: through 2024.1.8; from 2025.0.0 before 2025.0.8; from 2025.1.0 before 2025.1.4; 2026.0.0 — fixed in 2025.0.8, 2025.1.4

How to fix

Upgrade to a fixed version: Progress MOVEit Transfer 2025.0.8, 2025.1.4. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026

Get alerted when CVE-2026-10698 or the next vulnerability affects your stack