What is the CVSS score of CVE-2026-10698?

CVE-2026-10698 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MOVEit Transfer are affected by CVE-2026-10698?

Progress MOVEit Transfer's Custom Reports module contains a server-side NoSQL injection vulnerability (CVE-2026-10698, CVSS 7.2) that allows authenticated high-privilege users to read, modify, or…. A patch is available.

How to fix or mitigate CVE-2026-10698?

Within 24 hours: identify all MOVEit Transfer instances running versions 2025.0.x (before 2025.0.8), 2025.1.x (before 2025.1.4), or 2026.0.0 (before 2026.0.1); document which custom report users hold high-privilege roles. Within 7 days: restrict Custom Reports module access to the minimum set of high-privilege users; enable comprehensive audit logging on all report generation and data queries; implement network monitoring for unusual query patterns. Within 30 days: contact Progress for patch availability timeline; evaluate isolation or upgrade strategies for critical instances.

MOVEit Transfer CVE-2026-10698

EUVD-2026-42278 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-07-08 security@progress.com

GHSA-8rpj-q4gm-gm6v

Information Disclosure Nosql Injection Moveit Transfer Progress

7.2

CVSS 3.1 · Vendor: progress

Severity by source

Vendor (progress) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable web feature (AV:N/AC:L) but the Custom Reports injection requires an administrative/high-privilege account (PR:H); NoSQL injection can read, modify, and disrupt data, so C/I/A all High.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (progress).

CVSS VectorVendor: progress

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 16:01 EUVD

Analysis Generated

Jul 08, 2026 - 15:31 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

AnalysisAI

Server-side NoSQL injection in Progress MOVEit Transfer (Custom Reports modules) lets an authenticated high-privilege user inject crafted query elements to read, alter, or disrupt backend data. It affects MOVEit Transfer 2025.0.x before 2025.0.8, 2025.1.x before 2025.1.4, and 2026.0.0 before 2026.0.1, with full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

MOVEit Transfer is a widely deployed managed file transfer (MFT) product used to move sensitive files between organizations, typically internet-facing. The flaw is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and is tagged as NoSQL Injection, indicating the Custom Reports feature builds data queries against a NoSQL-style backend using unsanitized input. When special query elements (operators/expressions) are passed through the reporting logic without neutralization, an attacker can manipulate the query the application intended to run, altering filter logic or returning data outside the requester's authorized scope.

RemediationAI

Upgrade to a fixed release for your line: MOVEit Transfer 2025.0.8, 2025.1.4, or 2026.0.1 or later (Vendor-released patch: 2025.0.8 / 2025.1.4 / 2026.0.1, inferred from the 'before' boundaries in the affected-version data - confirm exact build against the vendor bulletin). Review the Progress advisory at https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026 for the authoritative fixed builds. Until patched, because exploitation requires a high-privilege account, tighten and audit administrative/reporting access: restrict who can create or run Custom Reports, remove unnecessary high-privilege accounts, and enforce strong authentication (MFA) on admin logins; disabling or restricting the Custom Reports module for non-essential users reduces the attack surface at the cost of losing that reporting functionality. Monitor application and query logs for anomalous report queries and unexpected data access.