CVE-2026-10699

Path equivalence vulnerability in the File Upload module of Progress MOVEit Transfer allows potential security bypass. Affects versions before 2025.0.8 and from 2025.1.0 before 2025.1.4.

Incorrect authorization vulnerability in the Audit User module of Progress MOVEit Transfer. The flaw allows unauthorized access to user audit functions.

Relative path traversal vulnerability in the Admin Settings module of Progress MOVEit Transfer. Allows an attacker to access files outside the intended directory.

An improper neutralization of special elements in data query logic vulnerability exists in Progress MOVEit Transfer (Custom Reports modules). Affected versions are before 2025.0.7 and from 2025.1.0 before 2025.1.3.

An XSS vulnerability was found in the Ad Hoc module of Progress MOVEit Transfer due to improper input neutralization during page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.

A vulnerability in Progress MOVEit Transfer's Custom Reports module involves improper neutralization of special elements in data query logic. This allows an attacker to manipulate queries, potentially leading to unauthorized data access.