AI analysis
CVE-2026-87093 is an incorrect permission assignment for a critical resource (CWE-732) in Progress MOVEit Transfer. A local attacker who already has low privileges can abuse the mis-assigned permissions without user interaction; the CVSS vector is local, low complexity, and low privilege, with changed scope and high impact to confidentiality, integrity, and availability. Successful abuse can therefore affect resources beyond the immediate component and fully compromise the security of the affected MOVEit host or service context. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025 line, or to 2026.0.4 or later on the 2026.0 line. Until patched, restrict local logons and low-privilege accounts on MOVEit hosts and review permissions on critical application resources. Confirm the running build after upgrade and watch vendor advisories; no public exploit is known.
Affected
| Progress MOVEit Transfer | before 2025.1.6, and 2026.0.0 before 2026.0.4 |
Estimated exposure
moderateroughly a few thousand internet-exposed instances, plus more internal enterprise deployments (order of thousands of systems) — MOVEit Transfer is enterprise managed-file-transfer software used by many organizations; public internet scans around prior MOVEit incidents typically showed on the order of a few thousand exposed instances, with additional internal…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.