AI analysis
CVE-2026-89070 is an authentication bypass by capture-replay (CWE-294) in the OIDC module of Progress MOVEit Transfer. A remote attacker with no prior privileges can replay a captured OIDC authentication exchange; the attack is network-reachable but rated high complexity and requires user interaction, and a successful bypass yields high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. MOVEit Transfer is an enterprise managed file-transfer product used by organizations that exchange sensitive files. There is no known public proof-of-concept and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is none known.
What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025.1 line, or to 2026.0.4 or later on the 2026.0 line, so the OIDC module is no longer in the affected ranges. Until patched, review OIDC sign-in logs for unexpected or replayed authentications and restrict exposure of the Transfer web interface. No public proof-of-concept is known and the issue is not listed in CISA KEV, but patch promptly given prior targeting of this product.
Affected
| Progress MOVEit Transfer | before 2025.1.6, and 2026.0.0 before 2026.0.4 |
Estimated exposure
moderatelow thousands of internet-facing instances; enterprise install base likely in the thousands to low tens of thousands — Progress does not publish install counts; public internet scans during the 2023 MOVEit incidents (Censys/Shodan) showed on the order of a few thousand exposed MOVEit Transfer servers, with a larger enterprise install base behind firewalls.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.