Cross-Site Scripting Vulnerability in Progress MOVEit Transfer Ad Hoc Module
CVE-2026-89069

8HIGH

Key Information:

Vendor

Progress

Status
Moveit Transfer
Vendor
CVE Published:
14 October 2026

What is CVE-2026-89069?

The web application associated with Progress MOVEit Transfer has a vulnerability that results from improper neutralization of user input during web page generation. This flaw can allow an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized actions being performed on behalf of the affected user. This issue is relevant for versions prior to 2025.1.6 and those from 2026.0.0 to 2026.0.4. Organizations using this software should upgrade to the latest versions to mitigate the risk.

Affected Version(s)

MOVEit Transfer 0 < 2025.1.6

MOVEit Transfer 2026.0.0 < 2026.0.4

References

https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matt Grover
.