Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress patched 12 MOVEit Transfer flaws, including authentication bypass, with no exploitation reported.
Progress Software patched 12 vulnerabilities in MOVEit Transfer affecting 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3. The highest-rated issues, CVE-2026-89067 and CVE-2026-87093, both score CVSS 8.8 and involve authentication bypass and incorrect permissions that can enable privilege escalation. Other flaws include session weaknesses, XSS, LDAP and SQL injection, and insecure storage of sensitive data. Fixes are in 2025.1.6 and 2026.0.4 via a full installer that causes an outage; Progress had not reported in-the-wild exploitation.
68