Progress Software Patches Twelve High-Severity MOVEit Transfer Vulnerabilities

TL;DR

Progress Software disclosed twelve high-severity MOVEit Transfer vulnerabilities on October 14, 2026. These security flaws enable authentication bypass, SQL injection, cross-site scripting, and local privilege escalation across managed file transfer environments. Consequently, system administrators must upgrade their installations immediately to prevent unauthorized system access.

Notable CVEs

Why It Matters

MOVEit Transfer is an enterprise managed file transfer (MFT) solution used by thousands of organizations worldwide to move sensitive data. While exact affected installation counts are not specified in the vendor bulletin, MFT servers remain prime targets for ransomware and data extortion groups.

According to the security bulletin, successful exploitation of these MOVEit Transfer vulnerabilities could allow attackers to bypass login controls, elevate privileges, or manipulate database queries. Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.

How the Attack Works

The twelve flaws span multiple core components, including the LDAP, OIDC, SFTP, Ad Hoc, Custom Reports, and Client Certificates modules.

Authentication Bypass and Access Control Flaws

First, two vulnerabilities carry the highest CVSS v3.1 base score of 8.8. CVE-2026-89067 (CWE-288) allows a remote attacker with low privileges to bypass authentication in Secure Messaging using an alternate path or channel. Meanwhile, CVE-2026-87093 (CWE-732) stems from incorrect permission assignments on critical service directories, allowing local users to escalate privileges.

Next, CVE-2026-89068 (CVSS 8.1) omits a critical authentication step (CWE-304) within the LDAP module, allowing unauthenticated network attackers to compromise the server. Additionally, CVE-2026-89070 (CVSS 7.5) permits authentication bypass via capture-replay attacks in the OIDC module. In the SFTP module, CVE-2026-89077 (CVSS 7.5) introduces an incorrect authentication algorithm implementation, while CVE-2026-89072 (CVSS 7.5) causes incorrect authorization in the Client Certificates module.

Injection and Session Management Bugs

Several other bugs target input validation and data storage. Specifically, CVE-2026-89069 (CVSS 8.0) is a cross-site scripting (XSS) flaw in the Ad Hoc module. Similarly, CVE-2026-89071 (CVSS 7.5) enables LDAP injection, and CVE-2026-89076 (CVSS 7.2) allows high-privileged attackers to execute SQL injection attacks in the Custom Reports module. Finally, Progress addressed insufficient session expiration (CVE-2026-89073), improper Unicode encoding handling (CVE-2026-89074), and insecure sensitive data storage (CVE-2026-89075).

Affected Versions

All twelve MOVEit Transfer vulnerabilities affect versions prior to 2025.1.6, as well as version 2026.0.0 through versions prior to 2026.0.4. Versions 2025.1.6 and 2026.0.4 are not affected.

Patch and Mitigation Steps

Progress Software resolved all twelve vulnerabilities in MOVEit Transfer versions 2025.1.6 and 2026.0.4. Administrators should download and apply the appropriate fixed release from the Progress Community portal immediately. In addition, security teams should audit local server directory permissions and restrict administrative console access to trusted networks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.