CVE-2026-89072: Incorrect authorization in Progress MOVEit Transfer · ZeroHour

CVE-2026-89072

moderate

Incorrect authorization in Progress MOVEit Transfer

CVSS 3.1

7.5 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89072 is an incorrect-authorization flaw (CWE-863) in the Client Certificates module of Progress MOVEit Transfer. A remote attacker who already has low privileges can trigger it over the network without user interaction, but only under conditions that raise attack complexity (CVSS 3.1 base 7.5, AC:H, PR:L). Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected system (C:H/I:H/A:H, scope unchanged). It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025 branch, and to 2026.0.4 or later on the 2026 branch. Prioritize internet-reachable servers, review Client Certificates configuration and recent certificate and authorization changes, and confirm the build in use after patching.

Affected

Progress MOVEit Transfer

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderatelow thousands of internet-facing MOVEit Transfer servers (historical public scan order of magnitude) — MOVEit Transfer is an enterprise managed-file-transfer product; historical public internet scans around prior MOVEit incidents found on the order of a few thousand exposed servers, not mass consumer installs.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89072

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation