CVE-2026-89073: Insufficient Session Expiration in Progress MOVEit Transfer · ZeroHour

CVE-2026-89073

moderate

Insufficient Session Expiration in Progress MOVEit Transfer

CVSS 3.1

7.5 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89073 is an insufficient session expiration flaw (CWE-613) in Progress MOVEit Transfer. Sessions can remain valid after they should have ended, and a remote attacker who can get a user to interact with a crafted condition may reuse that session. The CVSS 3.1 score is 7.5 (network, high complexity, no privileges, user interaction required) with high impact to confidentiality, integrity, and availability. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade MOVEit Transfer to 2025.1.6 or later on the 2025 branch, or to 2026.0.4 or later on the 2026 branch. After patching, invalidate existing sessions and confirm logout, password change, and idle timeout actually end sessions. There is no known public exploit or CISA KEV listing, but treat internet-facing instances as priority.

Affected

Progress MOVEit Transfer

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderatelow thousands of internet-exposed MOVEit Transfer servers (order of magnitude) — MOVEit Transfer is enterprise managed file transfer, not a consumer product; public internet scans around the 2023 incidents commonly showed on the order of a few thousand exposed hosts, so affected installations are estimated in the low…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-613
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89073

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation