Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Published: 2026-10-14
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Compromise
Action: Immediate Patch
AI Analysis

Impact

An SQL injection flaw exists in the Custom Reports module of Progress MOVEit Transfer, allowing an attacker to embed arbitrary SQL statements into report queries. This vulnerability can lead to unauthorized disclosure, modification, or deletion of data stored by MOVEit Transfer, thereby compromising the confidentiality, integrity, and availability of sensitive files and system state.

Affected Systems

The affected product is Progress MOVEit Transfer. Versions before 2025.1.6 are vulnerable, as are versions from 2026.0.0 up to but not including 2026.0.4. All releases equal to or newer than 2025.1.6 and 2026.0.4 are considered not affected.

Risk and Exploitability

The CVSS score of 7.2 classifies this issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. The flaw is triggered when a report query contains unneutralized special elements, allowing the execution of arbitrary SQL statements.

Generated by OpenCVE AI on October 15, 2026 at 19:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MOVEit Transfer to version 2025.1.6 or newer, or 2026.0.4 or newer.
  • If an upgrade is not immediately possible, disable the Custom Reports module to remove access to the vulnerable functionality.
  • Ensure that any user interface that accepts report parameters performs strict input validation and does not allow raw SQL syntax to be included in queries.

Generated by OpenCVE AI on October 15, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress moveit Transfer
Vendors & Products Progress
Progress moveit Transfer

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Title MOVEit Transfer SQL injection in custom reporting
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Progress Moveit Transfer
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T03:57:15.737Z

Reserved: 2026-09-10T18:47:56.872Z

Link: CVE-2026-89076

cve-icon Vulnrichment

Updated: 2026-10-14T19:04:31.085Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-14T16:17:55.967

Modified: 2026-10-19T12:13:14.830

Link: CVE-2026-89076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T15:15:14Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')