CVE-2026-10699: MOVEit Transfer Use-After-Free Flaw

CVE-2026-10699 Overview

CVE-2026-10699 is a memory leak vulnerability in the Custom Reports modules of Progress MOVEit Transfer. The flaw is classified under [CWE-401] Missing Release of Memory After Effective Lifetime. Remote, unauthenticated attackers can exhaust server memory by repeatedly triggering the vulnerable code path over the network. Successful exploitation degrades service availability and can crash the MOVEit Transfer instance, disrupting managed file transfer operations.

Critical Impact
An unauthenticated network attacker can trigger sustained memory exhaustion in MOVEit Transfer, causing denial of service against a widely deployed managed file transfer platform.

Affected Products

Progress MOVEit Transfer 2025.0.0 through versions before 2025.0.8
Progress MOVEit Transfer 2025.1.0 through versions before 2025.1.4
Progress MOVEit Transfer 2026.0.0 before 2026.0.1

Discovery Timeline

2026-07-08 - CVE-2026-10699 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-10699

Vulnerability Analysis

CVE-2026-10699 resides in the Custom Reports modules of MOVEit Transfer. The affected code allocates memory to service report-related requests but fails to release those allocations after the request lifetime ends. Repeated requests cause allocated memory to accumulate on the process heap. Over time, the MOVEit Transfer service consumes available system memory and enters an unstable state. The impact is limited to availability, with no confidentiality or integrity effects, according to the published CVSS vector.

Root Cause

The root cause is a missing deallocation path [CWE-401]. Objects, buffers, or handles created while processing Custom Reports operations are not freed on all execution paths. Because the leak lives inside a network-reachable feature that does not require authentication to trigger, attackers can amplify the effect with automated request loops.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and no privileges or user interaction. An attacker sends crafted HTTP requests to the Custom Reports endpoints of a MOVEit Transfer server. Each request causes the server to leak memory. Sustained request volume drives the host toward memory exhaustion, service crashes, or forced restarts, disrupting file transfer workflows for downstream business processes.

No public proof-of-concept exploit code is referenced in the advisory. Refer to the Progress MOVEit Transfer Bulletin for vendor technical details.

Detection Methods for CVE-2026-10699

Indicators of Compromise

Continuous growth of the MOVEit Transfer process working set and private bytes without corresponding user load
Repeated inbound HTTP requests targeting Custom Reports URLs from a small set of source IP addresses
Application pool recycles, out-of-memory events, or service restarts logged on the MOVEit Transfer host

Detection Strategies

Baseline normal memory utilization for the MOVEit Transfer service and alert on sustained upward drift
Inspect IIS or reverse proxy logs for high-frequency requests to Custom Reports endpoints from unauthenticated sessions
Correlate memory pressure events with spikes in request volume against report modules to identify exploitation attempts

Monitoring Recommendations

Enable Windows performance counters for process memory and commit charge on the MOVEit Transfer server
Forward IIS access logs and Windows event logs to a centralized platform for anomaly analysis
Track patch level against the fixed versions 2025.0.8, 2025.1.4, and 2026.0.1 across the fleet

How to Mitigate CVE-2026-10699

Immediate Actions Required

Upgrade MOVEit Transfer to 2025.0.8, 2025.1.4, or 2026.0.1 or later, matching the branch in use
Restrict network exposure of MOVEit Transfer to trusted networks and known partner IP ranges where feasible
Place the application behind a web application firewall configured to rate-limit requests to report endpoints

Patch Information

Progress has released fixed builds for each supported branch. Administrators should apply 2025.0.8 for the 2025.0.x line, 2025.1.4 for the 2025.1.x line, and 2026.0.1 for the 2026.0.x line. Full remediation details are documented in the Progress MOVEit Transfer Bulletin.

Workarounds

Apply strict rate limiting on Custom Reports endpoints at the load balancer or reverse proxy tier
Schedule proactive application pool recycles to reclaim leaked memory until patching is complete
Block anonymous access to reporting URLs where the deployment permits authentication enforcement

bash

# Example IIS request filtering to constrain Custom Reports request rate
# Configure Dynamic IP Restrictions module to block clients exceeding thresholds
appcmd set config /section:system.webServer/security/dynamicIpSecurity ^
  /denyByRequestRate.enabled:true ^
  /denyByRequestRate.maxRequests:20 ^
  /denyByRequestRate.requestIntervalInMilliseconds:1000