CVE-2026-10698

Executive Summary

CVE-2026-10698 is a critical vulnerability in Progress MOVEit Transfer, specifically within the Custom Reports module. The flaw is an improper neutralization of special elements in data query logic (CWE-943), which allows an authenticated attacker to inject malicious data query commands. This can lead to unauthorized data access and potential data exfiltration. The vulnerability affects multiple versions of MOVEit Transfer, and while no public proof-of-concept (PoC) or exploit code is currently available, the high CVSS score of 7.2 and the nature of the software (managed file transfer) make it a high-priority target for threat actors. The vendor has released patches, and immediate upgrading is strongly recommended.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but in a commercial enterprise software product. However, organizations using MOVEit Transfer should treat this as a critical supply chain risk, as the software is often used to handle sensitive data transfers between partners and internal systems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.2 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. The combination of low attack complexity, network exploitability, and high impact on confidentiality and integrity makes this a serious threat. The lack of public exploit code currently reduces immediate risk, but threat actors are likely to develop exploits quickly.

Deep Dive & Mechanics

The vulnerability resides in the Custom Reports module of MOVEit Transfer. This module allows users to create and execute custom SQL-like queries against the MOVEit database to generate reports. The flaw is an improper neutralization of special elements in data query logic, meaning user-supplied input is not properly sanitized before being used in a database query.

Attack Flow:

1. An attacker authenticates to the MOVEit Transfer web interface with a valid user account (low privileges required).
2. The attacker navigates to the Custom Reports functionality.
3. The attacker crafts a malicious report query that includes SQL injection payloads, bypassing the intended query logic.
4. The injected query is executed against the MOVEit database, allowing the attacker to read, modify, or delete arbitrary data.
5. The attacker can exfiltrate sensitive data (e.g., user credentials, file metadata, transfer logs) or manipulate the database.

Root Cause: The application fails to properly escape or parameterize user input when constructing database queries for custom reports. This is a classic SQL injection vulnerability, but categorized under CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) because it involves a custom query language rather than standard SQL.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but based on the CWE and typical fixes, the following illustrates the difference:

Vulnerable Code (Conceptual):

def execute_custom_report(user_input):
    query = "SELECT * FROM reports WHERE name = '" + user_input + "'"
    database.execute(query)

Patched Code (Conceptual):

def execute_custom_report(user_input):
    query = "SELECT * FROM reports WHERE name = ?"
    database.execute(query, (user_input,))

The patched version uses parameterized queries, which prevent injection by separating SQL code from data.

Exploitation & Lab Setup

Red Team (Offensive):

Since no public exploit code is available, a red team would need to develop a custom exploit. The following steps outline the approach:

1. Setup: Deploy a vulnerable MOVEit Transfer instance (e.g., version 2025.0.0) in an isolated lab environment.
2. Authentication: Create a low-privileged user account or use default credentials if available.
3. Identify Injection Point: Use a web proxy (e.g., Burp Suite) to intercept requests to the Custom Reports module. Look for parameters like report_name, query, or filter.
4. Test for Injection: Submit a single quote (') or a double quote (") in the parameter and observe error messages. A database error indicates a potential injection point.
5. Craft Payload: Use a time-based or error-based SQL injection technique to extract data. Example payload for time-based:

   ' OR IF(1=1, SLEEP(5), 0) --
   

6. Exploit: Once confirmed, use UNION-based or blind injection to extract sensitive data from the MOVEit database (e.g., mv_users table for credentials).

Blue Team (Defensive):

1. Detection: Monitor for unusual database query patterns, especially from the MOVEit application user. Look for queries containing SQL keywords like UNION, SELECT, SLEEP, or OR 1=1.
2. Honeypot: Deploy a decoy MOVEit instance with fake data to lure attackers and detect exploitation attempts.
3. Logging: Enable detailed logging for the MOVEit application and database. Correlate web requests with database queries.
4. Network Segmentation: Ensure MOVEit Transfer is in a segmented network with strict egress controls to prevent data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /MOVEit/Reports/ or similar endpoints with unusual query parameters.
  • Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Outbound connections from the MOVEit server to unknown IPs on non-standard ports (data exfiltration).

• Host IOCs:

  • Unusual database queries in MOVEit logs (e.g., SELECT * FROM mv_users).
  • Modified or deleted records in the MOVEit database.
  • New user accounts with elevated privileges created via the injection.

• File IOCs:

  • Temporary files or scripts created in the MOVEit web root (e.g., /MOVEit/App_Data/).

Detection Engineering

YARA Rule

rule CVE_2026_10698_MOVEit_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting MOVEit Transfer Custom Reports"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-10698"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "SLEEP(" nocase
        $sqli4 = "WAITFOR DELAY" nocase
        $sqli5 = "INTO OUTFILE" nocase
        $sqli6 = "information_schema" nocase
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-10698 MOVEit Transfer SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in HTTP requests to MOVEit Transfer Custom Reports
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - 'UNION SELECT'
            - 'OR 1=1'
            - 'SLEEP('
            - 'WAITFOR DELAY'
            - 'INTO OUTFILE'
            - 'information_schema'
    condition: selection
falsepositives:
    - Legitimate use of special characters in report names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-10698 MOVEit Transfer SQL Injection Attempt";
    flow:to_server,established;
    content:"/MOVEit/Reports/"; http_uri;
    pcre:"/(UNION\s+SELECT|OR\s+1=1|SLEEP\(|WAITFOR\s+DELAY|INTO\s+OUTFILE|information_schema)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade MOVEit Transfer to the latest patched version:
   • 2025.0.x → 2025.0.8
   • 2025.1.x → 2025.1.4
   • 2026.0.x → 2026.0.1
2. Workaround: If patching is not immediately possible, disable the Custom Reports module or restrict access to it via firewall rules or application-level access controls.
3. Review User Accounts: Audit all user accounts and remove any unnecessary privileges, especially for the Custom Reports feature.

Long-term Mitigations:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns.
2. Database Hardening: Use a database user with minimal privileges for the MOVEit application (e.g., no SELECT INTO OUTFILE or DROP TABLE).
3. Input Validation: Implement strict input validation and parameterized queries in all custom code.
4. Monitoring: Continuously monitor logs for suspicious database activity and web requests.

Valters IT