CVE-2026-8651: MOVEit Transfer Auth Bypass Vulnerability

CVE-2026-8651 Overview

CVE-2026-8651 is a limited authentication bypass by spoofing vulnerability in the HTTPS module of Progress MOVEit Transfer. The flaw affects MOVEit Transfer versions prior to 2025.0.7 and versions from 2025.1.0 up to (but not including) 2025.1.3. The weakness is categorized under [CWE-290] (Authentication Bypass by Spoofing) and requires network access plus high attack complexity to exploit. Successful exploitation permits limited impact against data integrity, without compromising confidentiality or availability.

Critical Impact
An unauthenticated network-based attacker can spoof identity claims to the HTTPS module and modify a limited subset of application state within Progress MOVEit Transfer.

Affected Products

Progress MOVEit Transfer versions before 2025.0.7
Progress MOVEit Transfer versions from 2025.1.0 before 2025.1.3
Progress MOVEit Transfer HTTPS module

Discovery Timeline

2026-07-08 - CVE-2026-8651 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-8651

Vulnerability Analysis

CVE-2026-8651 resides in the HTTPS module of Progress MOVEit Transfer, the web-facing interface used for browser-based file transfer sessions. The vulnerability enables an attacker to bypass authentication by spoofing identity data trusted by the module. Because the attack is limited in scope, only integrity is affected — the attacker cannot read confidential file contents or take the service offline through this flaw alone. Exploitation requires specific runtime or network conditions that raise attack complexity, but does not require any privileges or user interaction. Progress addressed the issue in MOVEit Transfer 2025.0.7 and 2025.1.3 per the vendor's release notes.

Root Cause

The root cause is improper verification of identity assertions inside the HTTPS module, classified under [CWE-290]. The module accepts identity-bearing input without sufficient cryptographic or contextual validation, allowing an attacker to impersonate a session or actor under specific conditions. Progress has not published detailed technical internals, and no public proof-of-concept exists at the time of writing.

Attack Vector

The attack vector is remote over the network against an exposed MOVEit Transfer HTTPS endpoint. An attacker crafts spoofed HTTPS requests that the module treats as originating from a legitimate authenticated context. The bypass yields limited write or state-modification capability rather than full account takeover. Refer to the Progress Release Notes 2026 for vendor-published fix information.

Detection Methods for CVE-2026-8651

Indicators of Compromise

Unexpected HTTPS requests to MOVEit Transfer endpoints containing malformed or duplicated authentication headers, tokens, or session identifiers.
Application audit log entries showing actions performed by a user without a preceding successful login event.
Anomalous source IP addresses interacting with authenticated MOVEit workflows outside of normal user or automation patterns.

Detection Strategies

Compare MOVEit Transfer application logs against upstream reverse proxy or load balancer access logs to identify sessions that lack a corresponding authentication transaction.
Baseline normal HTTPS request patterns to /api/v1 and web UI endpoints, then alert on deviations in headers, cookies, or request sequencing.
Correlate MOVEit audit events with network telemetry to detect state changes attributable to unauthenticated sources.

Monitoring Recommendations

Enable verbose audit logging in MOVEit Transfer and forward logs to a centralized SIEM for correlation and retention.
Monitor the vendor's advisory channel and the Progress Release Notes 2026 for follow-on advisories.
Track EPSS movement for CVE-2026-8651, which currently sits at 0.216% probability and the 11.968 percentile.

How to Mitigate CVE-2026-8651

Immediate Actions Required

Inventory all MOVEit Transfer instances and identify any running versions below 2025.0.7 or in the 2025.1.0 through 2025.1.2 range.
Restrict inbound access to the MOVEit HTTPS module to trusted networks or via a web application firewall until patching is complete.
Rotate administrative credentials and API keys if unauthorized state changes are observed in audit logs.

Patch Information

Progress has released fixed builds 2025.0.7 and 2025.1.3 of MOVEit Transfer that remediate CVE-2026-8651. Upgrade instructions and complete fix details are documented in the Progress Release Notes 2026. Apply the appropriate fixed version for your deployment branch and validate service functionality after the upgrade.

Workarounds

Place MOVEit Transfer behind a reverse proxy or WAF that strips or normalizes client-supplied authentication headers before they reach the HTTPS module.
Enforce mutual TLS or IP allow-listing on the MOVEit HTTPS endpoint to reduce the population of clients able to reach the vulnerable code path.
Disable public exposure of the HTTPS module where business requirements allow, until the patched version is deployed.

bash

# Configuration example: restrict MOVEit HTTPS module exposure at the perimeter
# (illustrative iptables rule — adapt to your environment)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP