CVE-2026-89077: Auth algorithm flaw in Progress MOVEit Transfer SFTP · ZeroHour

CVE-2026-89077

moderate

Auth algorithm flaw in Progress MOVEit Transfer SFTP

CVSS 3.1

7.5 high

EPSS

—

Published

Oct 14, 2026 (2d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-89077 is an incorrect implementation of an authentication algorithm (CWE-303) in the SFTP module of Progress MOVEit Transfer. It is reachable over the network by an attacker who already has low-privileged access, but attack complexity is high and no user interaction is required. Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected system (CVSS 3.1 base score 7.5). It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Upgrade Progress MOVEit Transfer to 2025.1.6 or later on the 2025.1 line, and to 2026.0.4 or later on the 2026.0 line. Until patched, restrict SFTP exposure to trusted networks, review low-privilege SFTP accounts, and watch authentication and file-transfer logs for unexpected access.

Affected

Progress MOVEit Transfer (SFTP module)

before 2025.1.6, and 2026.0.0 before 2026.0.4

Estimated exposure

moderatelow thousands of deployments (roughly 1,000–10,000 internet-exposed systems) — MOVEit Transfer is an enterprise managed-file-transfer product; public internet scans after prior MOVEit incidents have typically shown on the order of a few thousand exposed servers, not a mass consumer install base.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Weakness: CWE-303
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-89077

In the news1 stories

Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation