Authentication Vulnerability in MOVEit Transfer by Progress
CVE-2026-89068

8.1HIGH

Key Information:

Vendor

Progress

Status
Moveit Transfer
Vendor
CVE Published:
14 October 2026

What is CVE-2026-89068?

A significant vulnerability exists in Progress MOVEit Transfer’s LDAP module due to a missing critical step in the authentication process. This flaw affects versions of MOVEit Transfer prior to 2025.1.6 and those from 2026.0.0 through to before 2026.0.4. Exploitation of this vulnerability could allow unauthorized users to bypass authentication mechanisms, potentially leading to unauthorized access and data breaches.

Affected Version(s)

MOVEit Transfer 0 < 2025.1.6

MOVEit Transfer 2026.0.0 < 2026.0.4

References

https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leo Oliver (ssrfer)
.