CVE-2026-10699

⚠️ high

Summary

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

CVSS Score

7.5

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-07-08

First Seen: 2026-07-09

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.

#107,108

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 8, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-07-10

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-401

📦 Affected Products 4

Vendor	Product	Status	Affected Versions
progress	moveit_transfer	Affected	< 2024.1.8
progress	moveit_transfer	Affected	> 2025.0.0 < 2025.0.8
progress	moveit_transfer	Affected	> 2025.1.0 < 2025.1.4
progress	moveit_transfer	Affected	v2026.0.0

🔗 References 1

https://community.progress.com/s/article/MOVEit-Tran...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-10697	⚠️ high	7.5	0.2	Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,...	2026-07-23
CVE-2026-15966	⚠️ high	7.5	0.2	Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue af...	2026-07-23
CVE-2026-15967	⚠️ high	7.5	0.2	Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2...	2026-07-23
CVE-2026-15968	⚠️ high	7.1	0.2	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr...	2026-07-23
CVE-2026-10698	⚠️ high	7.2	0.4	Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report...	2026-07-08
CVE-2026-11903	⚠️ high	8.0	0.2	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr...	2026-07-08

These CVEs affect the same products