LDAP Injection Vulnerability in MOVEit Transfer by Progress
CVE-2026-89071

7.5HIGH

Key Information:

Vendor

Progress

Status
Moveit Transfer
Vendor
CVE Published:
14 October 2026

What is CVE-2026-89071?

An LDAP injection vulnerability has been identified in Progress MOVEit Transfer, specifically within its LDAP module. The flaw arises from improper neutralization of special characters used in LDAP queries, allowing potential attackers to execute unauthorized LDAP commands. This can result in unauthorized access to sensitive data or manipulation of directory services. Users of MOVEit Transfer should ensure they are using patched versions to mitigate this security concern.

Affected Version(s)

MOVEit Transfer 0 < 2025.1.6

MOVEit Transfer 2026.0.0 < 2026.0.4

References

https://community.progress.com/s/article/MOVEit-Transfer-...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bugbunny.ai
.