Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Progress/MOVEit Transfer (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Progress/MOVEit Transfer.
2. 2Review the reported fix. Update Progress/MOVEit Transfer to 2025.0.8 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 10, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 8, 2026

Sources and claim methodology

• Source referencecommunity.progress.com

Related CVEs

• ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterSame generic ecosystem
• VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL InjectionSame generic ecosystem
• Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL InjectionSame generic ecosystem
• VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site ScriptingSame generic ecosystem
• Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to AdministratorSame generic ecosystem
• Baserow 2FA Verify Endpoint views.py verify improper authenticationSame generic ecosystem

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Progress/MOVEit Transfer (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Progress/MOVEit Transfer.
2. 2Review the reported fix. Update Progress/MOVEit Transfer to 2025.0.8 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 10, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 8, 2026

Sources and claim methodology

• Source referencecommunity.progress.com

Related CVEs

• ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterSame generic ecosystem
• VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL InjectionSame generic ecosystem
• Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL InjectionSame generic ecosystem
• VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site ScriptingSame generic ecosystem
• Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to AdministratorSame generic ecosystem
• Baserow 2FA Verify Endpoint views.py verify improper authenticationSame generic ecosystem