MOVEit Transfer EUVD-2026-42278

Exploitation requires an authenticated, high-privilege account (CVSS PR:H) with access to the Custom Reports module - the specific feature named in the description - so this is not exploitable by anonymous or low-privilege users. The vector is network-based (AV:N) with low complexity (AC:L) and no user interaction (UI:N), meaning once a privileged session exists the injection can be delivered remotely over the normal web interface. The primary limiting factors are the privilege requirement and the need for the Custom Reports functionality to be reachable/enabled for the attacker's account; running a fixed build (2025.0.8, 2025.1.4, or 2026.0.1) removes the condition entirely.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but gated behind PR:H (high privileges), which materially limits the attacker population to already-privileged/administrative accounts. That single factor is the difference between this and the unauthenticated, mass-exploited MOVEit flaws of prior years; the full C:H/I:H/A:H impact triple is what keeps the score high despite the privilege requirement. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input. Given MOVEit's history as a high-value target for data-theft actors, a privileged-access NoSQL injection is a credible priority for hardening even though, on current signals, it reads as a post-authentication privilege/data-exposure issue rather than a wormable, internet-wide threat.

A user who already holds high privileges in MOVEit Transfer (for example a compromised administrator or malicious operator) crafts a Custom Report request containing special NoSQL query operators. The application incorporates the input into its data query without neutralization, letting the attacker return records outside their intended scope or tamper with underlying data. No public exploit code was identified, and the low attack complexity means a valid privileged session is the main prerequisite.