Known vulnerabilities in MOVEit WAF

Known vulnerabilities in MOVEit WAF

Vendor: Progress Software Corporation

Software: MOVEit WAF

Software CPE: cpe:2.3:a:progress_software_corporation:moveit_waf:*:*:*:*:*:*:*:*

Website: https://www.progress.com/

Total vulnerabilities: 12

Public exploits: 0

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (12)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU139980 - Command injection CVE-2026-59686	CWE-77	Low	No	No	7.2.63.3	27.07.2026	SB2026072949 SB2026072950
#VU139981 - Command injection CVE-2026-59687	CWE-77	Low	No	No	7.2.63.3	27.07.2026	SB2026072949 SB2026072950
#VU139982 - Command injection CVE-2026-59688	CWE-77	Low	No	No	7.2.63.3	27.07.2026	SB2026072949 SB2026072950
#VU139983 - Incorrect Authorization CVE-2026-59689	CWE-863	Medium	No	No	7.2.63.3	27.07.2026	SB2026072949 SB2026072950
#VU139984 - Missing Authorization CVE-2026-59690	CWE-862	Medium	No	No	7.2.63.3	27.07.2026	SB2026072949 SB2026072950
#VU133434 - Command injection CVE-2026-8037	CWE-77	Critical	No	Exploited	7.2.63.2	05.06.2026	SB2026060530 SB2026060531
#VU126712 - Improper Handling of Case Sensitivity CVE-2026-33691	CWE-178	Medium	No	No	7.2.63.2	21.04.2026	SB2026042189 SB2026060530 SB2026060531
#VU126648 - Command injection CVE-2026-3517	CWE-77	Low	No	No	7.2.63.0	21.04.2026	SB2026042138 SB2026042142
#VU126649 - Command injection CVE-2026-3518	CWE-77	Low	No	No	7.2.63.0	21.04.2026	SB2026042138 SB2026042142
#VU126650 - Command injection CVE-2026-3519	CWE-77	Low	No	No	7.2.63.0	21.04.2026	SB2026042138 SB2026042142
#VU126651 - Command injection CVE-2026-4048	CWE-77	Low	No	No	7.2.63.0	21.04.2026	SB2026042138 SB2026042142
#VU121073 - Incomplete Filtering of Multiple Instances of Special Elements CVE-2026-21876	CWE-794	Medium	No	No	7.2.63.0	07.01.2026	SB2026010786 SB2026011694 SB2026011695 and 8 more