CVE-2026-10699 Memory leak in SFTP service can result in a denial of service in MOVEit Transfer

High 7.5 Published 8 Jul 2026 Updated 8 Jul 2026

A memory leak in the SFTP service allows attackers to cause a denial of service in MOVEit Transfer.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-10699?

CVE-2026-10699 is a high-severity denial of service vulnerability in Progress MOVEit Transfer, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).

This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

Weakness: CWE-401

Which versions are affected by CVE-2026-10699?

It affects 1 product.

Products include Progress Moveit Transfer.

How do I fix CVE-2026-10699?

No fix has been published for CVE-2026-10699 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-10699 being exploited?

There is no known exploitation of CVE-2026-10699 in the wild and no public exploit code.

Sources

Also known as GHSA-r246-g2w6-6gr3.