CVE-2026-89071: LDAP Injection in Progress MOVEit Transfer · ZeroHour

CVE-2026-89071

moderate

LDAP Injection in Progress MOVEit Transfer

CVSS 3.1

7.5 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89071 is an LDAP injection flaw (CWE-90) in the LDAP module of Progress MOVEit Transfer. A remote attacker who already has low-privileged access can supply specially crafted input that is not neutralized before it is used in an LDAP query; attack complexity is rated high and no user interaction is required. Successful exploitation can affect confidentiality, integrity, and availability of the LDAP-backed data or directory interaction with high impact, within the same security scope. It affects MOVEit Transfer releases before 2025.1.6 and the 2026.0.0 line before 2026.0.4. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025 line, or to 2026.0.4 or later on the 2026 line. Until patched, restrict use of the LDAP authentication module to trusted accounts and networks, and review LDAP and authentication logs for unexpected query patterns or directory changes.

Affected

Progress MOVEit Transfer

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderate≈1,000–10,000 deployments (subset using the LDAP module unknown) — MOVEit Transfer is widely deployed enterprise managed-file-transfer software; public internet scans around prior MOVEit incidents typically showed on the order of a few thousand exposed servers, and only installs that use the optional LDAP…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-90
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89071

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation