CVE-2026-89076: SQL Injection in Progress MOVEit Transfer Custom Reports · ZeroHour

CVE-2026-89076

moderate

SQL Injection in Progress MOVEit Transfer Custom Reports

CVSS 3.1

7.2 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89076 is a SQL injection flaw (CWE-89) in the Custom Reports module of Progress MOVEit Transfer. An attacker who already holds a high-privileged account can send crafted input over the network that is not properly neutralized before it is used in an SQL command; no additional user interaction is required. Successful exploitation can read, modify, or disrupt the underlying data, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). Organizations running MOVEit Transfer before 2025.1.6, or from 2026.0.0 before 2026.0.4, are affected. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Upgrade Progress MOVEit Transfer to 2025.1.6 or later on the 2025 line, or to 2026.0.4 or later on the 2026 line. Until the update is applied, restrict Custom Reports and other high-privilege accounts to trusted administrators and review those accounts and report activity for unexpected queries or data changes.

Affected

Progress MOVEit Transfer

before 2025.1.6; from 2026.0.0 before 2026.0.4

Estimated exposure

moderateon the order of 1,000–10,000 internet-facing enterprise deployments — Estimate based on MOVEit Transfer being an enterprise managed-file-transfer product whose publicly reported internet-exposed footprint during the 2023 incident was a few thousand servers, not a mass consumer install base.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89076

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation