EUVD-2026-42279
GHSA-r246-g2w6-6gr3
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Denial of service in Progress MOVEit Transfer (Custom Reports modules) allows remote attackers to exhaust server memory through a missing-release-of-memory (memory leak) flaw, degrading availability of the managed file transfer service. It affects MOVEit Transfer 2025.0.x before 2025.0.8, 2025.1.x before 2025.1.4, and 2026.0.0 before 2026.0.1, and is addressed in the Progress Critical Security Bulletin of June 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (progress) · only source for this CVE.
CVSS VectorVendor: progress
Lifecycle Timeline
1DescriptionCVE.org
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).
This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
Executive ViewAI
Progress MOVEit Transfer contains a memory exhaustion vulnerability in its Custom Reports module that allows remote attackers to degrade service availability. Organizations relying on MOVEit Transfer for managed file transfer operations face potential service disruptions. No vendor-released patch has been identified at time of analysis and no public exploit code is currently available, requiring interim protective controls while awaiting a vendor release.
24 hours: Inventory all systems running MOVEit Transfer and identify those on versions 2025.0.x (before 2025.0.8), 2025.1.x (before 2025.1.4), and 2026.0.0 (before 2026.0.1); document exposure scope. 7 days: Implement network segmentation to restrict MOVEit Transfer access, configure enhanced monitoring for abnormal memory consumption and service degradation patterns, and establish alerting thresholds. 30 days: Monitor Progress security advisories for patch availability; develop and test upgrade plan to Progress MOVEit Transfer 2025.0.8, 2025.1.4, or 2026.0.1 or later.
Implement network-level access controls and rate limiting to restrict exposure to the Custom Reports module; enable continuous memory usage monitoring with automated alerts on threshold breaches; configure service restart policies to mitigate prolonged memory exhaustion; implement reverse-proxy or WAF rules to throttle requests to report-generation endpoints if available; evaluate resource quotas and memory limits at the operating system level.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB