CVE-2026-89068: LDAP authentication bypass in Progress MOVEit Transfer · ZeroHour

CVE-2026-89068

moderate

LDAP authentication bypass in Progress MOVEit Transfer

CVSS 3.1

8.1 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89068 is a missing critical step in authentication (CWE-304) in the LDAP module of Progress MOVEit Transfer. A remote, unauthenticated attacker can trigger it over the network without user interaction, but only under conditions that make exploitation more difficult (CVSS 3.1 base score 8.1, AC:H). Successful exploitation can compromise confidentiality, integrity, and availability of the affected transfer service at a high level. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025.1 line, and to 2026.0.4 or later on the 2026.0 line. Prioritize internet-facing hosts that use LDAP authentication, confirm the LDAP module is patched, and review authentication and transfer logs for unexpected successful logons.

Affected

Progress MOVEit Transfer

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderatelow thousands of internet-exposed servers, fewer if limited to LDAP-auth deployments — MOVEit Transfer is enterprise managed-file-transfer software; public internet scans during the 2023 incidents found on the order of a few thousand exposed servers, and only deployments using the LDAP authentication module are in scope for…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-304
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89068

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation