AI analysis
CVE-2026-89069 is a cross-site scripting flaw (CWE-79) in the Ad Hoc module of Progress MOVEit Transfer. An authenticated user with low privileges can supply input that is not properly neutralized when a web page is generated; the script runs in another user's browser if that user views the page (user interaction required). Progress rates the issue high (CVSS 8.0, network, low complexity) with high impact to confidentiality, integrity, and availability, consistent with actions taken in the victim's session rather than unauthenticated remote code execution. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Upgrade MOVEit Transfer on the 2025 branch to 2025.1.6 or later, and on the 2026 branch to 2026.0.4 or later. Until then, limit who can use the Ad Hoc module, treat unexpected links or content in Ad Hoc pages as untrusted, and review access logs for unusual authenticated activity.
Affected
| Progress MOVEit Transfer (Ad Hoc module) | before 2025.1.6, and 2026.0.0 before 2026.0.4 |
Estimated exposure
moderate≈1,000–10,000 internet-facing systems (order of magnitude); total internal installs unknown — MOVEit Transfer is commercial enterprise file-transfer software; public internet scans after the 2023 incidents typically showed on the order of a few thousand exposed hosts rather than a mass consumer install base, and only deployments…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.