CVE-2026-8651 — IPv6 loopback spoofing via a trusted Host header bypasses the origin check in MOVEit Transfer

Progress MOVEit Transfer’s HTTPS module contains a limited authentication-bypass-by-spoofing vulnerability.