CVE-2026-8650: MOVEit Transfer Path Traversal Vulnerability

CVE-2026-8650 Overview

CVE-2026-8650 is a relative path traversal vulnerability [CWE-23] in the Admin Settings module of Progress MOVEit Transfer. The flaw allows an authenticated administrator on an adjacent network to reference files outside the intended directory by supplying crafted relative path segments. Successful exploitation exposes sensitive files readable by the MOVEit Transfer service account, impacting confidentiality without altering data or availability. The issue affects MOVEit Transfer versions before 2025.0.7 and versions from 2025.1.0 before 2025.1.3. Progress addressed the flaw in the 2026 release cycle and documented the fix in the vendor release notes.

Critical Impact
Authenticated adversaries with administrative privileges on an adjacent network can read files outside the Admin Settings directory scope, exposing configuration and secrets material.

Affected Products

Progress MOVEit Transfer versions prior to 2025.0.7
Progress MOVEit Transfer versions from 2025.1.0 up to (but not including) 2025.1.3
MOVEit Transfer Admin Settings module

Discovery Timeline

2026-07-08 - CVE-2026-8650 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-8650

Vulnerability Analysis

The vulnerability resides in the Admin Settings module of Progress MOVEit Transfer, a managed file transfer platform used for regulated data exchange. The module accepts input that is used to construct file paths but fails to canonicalize or constrain those paths to an approved base directory. As a result, sequences such as ../ traverse outside the intended location and resolve to arbitrary files on the host filesystem.

The issue is classified under CWE-23 (Relative Path Traversal). Exploitation requires an authenticated session with high privileges and access from an adjacent network segment. The attack does not require user interaction. Confidentiality impact is high because the MOVEit service typically runs with permissions to read application configuration, logs, and cryptographic material.

Root Cause

The root cause is insufficient validation and normalization of user-supplied path components within the Admin Settings handler. The module trusts the administrator-provided path fragment and joins it to a base directory without rejecting .. traversal tokens or verifying that the resolved path remains inside the permitted boundary.

Attack Vector

An authenticated administrator on the adjacent network submits a crafted request to an Admin Settings endpoint containing relative traversal sequences in a path parameter. The server resolves the path against the local filesystem and returns or processes the referenced file. Because the vulnerability requires high privileges, it is most relevant in scenarios involving compromised administrator credentials, insider misuse, or lateral movement into the management network.

No verified public proof of concept is available. Refer to the Progress MOVEit Transfer Release Notes for vendor technical details.

Detection Methods for CVE-2026-8650

Indicators of Compromise

Requests to MOVEit Transfer Admin Settings endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in path or filename parameters.
Administrative sessions originating from unexpected internal subnets or workstations that do not typically manage MOVEit.
Access to sensitive files (web.config, appsettings.json, key material, logs) correlated with Admin Settings activity in application logs.

Detection Strategies

Enable verbose audit logging on MOVEit Transfer administrative interfaces and forward events to a centralized SIEM for path-parameter inspection.
Alert on administrator requests where path parameters contain traversal patterns after URL decoding.
Baseline normal administrator activity and flag deviations such as access to configuration files or unusual file read volumes from the Admin Settings module.

Monitoring Recommendations

Monitor authentication events for the administrator role and correlate with source IP and network segment.
Track file access on the MOVEit host for reads outside the expected Admin Settings directory tree.
Review web application firewall (WAF) logs for traversal signatures targeting MOVEit administrative paths.

How to Mitigate CVE-2026-8650

Immediate Actions Required

Upgrade MOVEit Transfer to version 2025.0.7, 2025.1.3, or later per the Progress fixed-issues advisory.
Restrict management-plane network access so the Admin Settings interface is not reachable from general user or adjacent segments.
Rotate administrator credentials and audit administrator role assignments to reduce the pool of accounts that meet the privilege prerequisite.

Patch Information

Progress addressed CVE-2026-8650 in MOVEit Transfer 2025.0.7 and 2025.1.3. The remediation is documented in the Progress MOVEit Transfer Release Notes. Apply the update in a maintenance window after validating in a staging environment.

Workarounds

Limit administrative access to a dedicated jump host or bastion, and enforce multi-factor authentication for all administrator logins.
Deploy a WAF rule to block traversal sequences (../, encoded variants) in requests to MOVEit administrative endpoints until patching is complete.
Reduce standing administrator privileges through just-in-time access controls to shrink the exploitation window.

bash

# Example WAF rule pattern (ModSecurity-style) to block traversal in MOVEit admin paths
SecRule REQUEST_URI "@rx /admin/" \
  "chain,phase:2,deny,status:403,id:1026865001,msg:'MOVEit Admin path traversal attempt (CVE-2026-8650)'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)" "t:urlDecodeUni,t:lowercase"