External risk intelligence

Progress MOVEit Transfer Path Equivalence Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-8801

Progress MOVEit Transfer is a managed file transfer solution designed specifically to be deployed as an internet-facing gateway for external data exchange, making its web-based file upload modules inherently exposed to the public internet in standard configurations.

Progress Moveit Transfer

before 2025.0.82025.1.0 to before 2025.1.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Progress MOVEit Transfer's file upload functionality. This issue allows for path traversal, potentially enabling unauthorized access and modification of files. Given MOVEit Transfer's typical role as an external data exchange gateway, this vulnerability warrants attention to confirm its relevance and exposure within our environment.

Affects file uploads in MOVEit Transfer.
Critical flaw, easily exploitable over the network.
Confirm relevance and determine exposure status.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerability by exploiting a weakness in Progress MOVEit Transfer's file upload functionality, which is often exposed to the internet. This could allow an unauthenticated attacker to gain unauthorized access, leading to severe consequences.

No authentication required.
Uploading files triggers the vulnerability.
Complete system compromise possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Progress MOVEit Transfer's file upload modules could allow an unauthenticated attacker to exploit path equivalence, potentially leading to unauthorized access and modification of sensitive system or user data when the system is exposed to the internet.

System files and user data.
Via specially crafted file uploads.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Progress MOVEit Transfer, such as application owners, infrastructure, or platform teams, should take the lead in addressing this vulnerability. The first practical step is to identify all instances of MOVEit Transfer within the environment, confirm their internet reachability and business criticality, and then identify the accountable owner before planning remediation based on assessed risk.

Identify affected MOVEit Transfer instances.
Verify internet exposure and business criticality.
Plan remediation with accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MOVEit Transfer?

Progress MOVEit Transfer is a managed file transfer solution that organizations use to securely share, store, and exchange sensitive data. It is commonly deployed as a gateway to facilitate data movement between internal systems and external partners or clients.

What does path equivalence mean for CVE-2026-8801?

This vulnerability involves a weakness known as path equivalence (CWE-46). It means the software fails to properly distinguish between different ways of referencing the same file path. In this CVE, an attacker can manipulate file paths during the upload process to bypass restrictions, potentially accessing or modifying sensitive files they should not be able to reach.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted file upload request to the application. Because the vulnerability exists within the file upload modules, successful exploitation does not require the attacker to have an existing user account or authentication credentials. Simply interacting with the upload function can be enough to initiate the path manipulation.

Why is this CVE high-risk for my infrastructure?

According to Halo Surface Signal, MOVEit Transfer is designed to be an internet-facing gateway, meaning these upload modules are often directly accessible from the public internet by default. This high level of exposure means that an attacker anywhere on the internet could attempt to access your system without needing to bypass your internal perimeter security first.

What are the first steps to address this issue?

Begin by creating an inventory of all MOVEit Transfer instances currently running in your environment. Once identified, confirm which instances are accessible via the internet and determine their business criticality. Coordinate with the designated owners of these systems to assess your specific risk level and prepare for the necessary software updates to secure the platform.

References

docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.