CVE-2026-89067: Authentication bypass in Progress MOVEit Transfer · ZeroHour

CVE-2026-89067

moderate

Authentication bypass in Progress MOVEit Transfer

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89067 is an authentication-bypass-via-alternate-path flaw (CWE-288) in Progress MOVEit Transfer. A remote attacker who already has low-privileged access can use an alternate path or channel to bypass authentication controls, without user interaction. Successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected transfer system (CVSS 3.1 base score 8.8). It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025.1 line, and to 2026.0.4 or later on the 2026.0 line. Until patched, restrict network access to the transfer service to trusted users and networks and review authentication and file-transfer logs for unexpected privilege use. No public exploit or CISA KEV listing is known, but the issue is remotely reachable with only low privileges, so patch promptly.

Affected

Progress MOVEit Transfer

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderatelow thousands of internet-exposed servers (order of magnitude) — MOVEit Transfer is an enterprise managed file-transfer product; public internet scans after prior MOVEit incidents have typically shown on the order of a few thousand exposed instances, not a mass consumer install base.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-288
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89067

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation