Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress patched 12 MOVEit Transfer flaws, including authentication bypass, with no exploitation reported.
Progress Software patched 12 vulnerabilities in MOVEit Transfer affecting 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3. The highest-rated issues, CVE-2026-89067 and CVE-2026-87093, both score CVSS 8.8 and involve authentication bypass and incorrect permissions that can enable privilege escalation. Other flaws include session weaknesses, XSS, LDAP and SQL injection, and insecure storage of sensitive data. Fixes are in 2025.1.6 and 2026.0.4 via a full installer that causes an outage; Progress had not reported in-the-wild exploitation.
- Twelve CVEs affect MOVEit Transfer through 2025.0.8, 2025.1.0–2025.1.5, and 2026.0.0–2026.0.3.
- CVE-2026-89067 and CVE-2026-87093 both score CVSS 8.8.
- Fixed builds are 2025.1.6 and 2026.0.4; full-installer upgrades cause downtime.
- Progress reported no exploitation in the wild in the bulletin.
- The 2023 Cl0p MOVEit campaign makes authentication flaws especially urgent.
Vulnerabilities mentionedAll →
- CVE-2026-870938.8—Incorrect permission assignment in Progress MOVEit Transferpublished · Progress MOVEit Transfer+11 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87093 |
Full article499 words · extracted from gbhackers.com · click to collapse
Progress Software has released fixes for 12 vulnerabilities in MOVEit Transfer, its managed file transfer (MFT) platform. Several of the flaws allow authentication bypass, session hijacking and administrative control.
The company’s September 2026 critical security bulletin, published October 15, 2026, urges customers to upgrade immediately.
MOVEit Transfer vulnerabilities
According to the September 2026 critical security bulletin published by Progress Software, the flaws affect MOVEit Transfer 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3.
Progress says exploitation could lead to unauthorized access, administrative control, data exposure, service instability and resource exhaustion. Reported symptoms include session hijacking, data loss and service interruptions.
All of the CVEs are resolved in versions 2025.1.6 and 2026.0.4. Progress had not reported exploitation in the wild in the bulletin text provided.
| CVE | Weakness | CVSS |
| CVE-2026-89067 | CWE-288 Authentication bypass via alternate path or channel | 8.8 |
| CVE-2026-87093 | CWE-732 Incorrect permission assignment for critical resource | 8.8 |
| CVE-2026-89068 | CWE-304 Missing critical step in authentication | 8.1 |
| CVE-2026-89069 | CWE-79 Cross-site scripting | 8.0 |
| CVE-2026-89074 | CWE-176 Improper handling of Unicode encoding | 7.5 |
| CVE-2026-89070 | CWE-294 Authentication bypass by capture-replay | 7.5 |
| CVE-2026-89077 | CWE-303 Incorrect implementation of authentication algorithm | 7.5 |
| CVE-2026-89073 | CWE-613 Insufficient session expiration | 7.5 |
| CVE-2026-89072 | CWE-863 Incorrect authorization | 7.5 |
| CVE-2026-89071 | CWE-90 LDAP injection | 7.5 |
| CVE-2026-89075 | CWE-922 Insecure storage of sensitive information | 7.3 |
| CVE-2026-89076 | CWE-89 SQL injection | 7.2 |
The two highest-rated flaws, CVE-2026-89067 and CVE-2026-87093, both score 8.8. The first lets an attacker reach protected functions through an alternate path or channel. The second involves incorrect permissions on a critical resource, which can enable privilege escalation.
Several other bugs target authentication directly. They include a missing authentication step, a capture-replay weakness, a flawed authentication algorithm and insufficient session expiration.
Chained together, these could let an attacker take over sessions or gain administrative access. The LDAP and SQL injection flaws add risks of directory manipulation and database exposure.
MOVEit has a troubled history. The 2023 Cl0p campaign exploited a MOVEit SQL injection zero-day and affected thousands of organizations. Defenders should therefore treat any MOVEit authentication flaw as high priority, even without confirmed exploitation.
Researchers credited include Leo Oliver (ssrfer), who reported three of the flaws. Maciej “mace” Nowak of Robert Bosch, Poland, reported two. Matt Grover, Mateusz Mieczkowski and Ryan Vinton each reported one.
The AI-driven platform bugbunny.ai reported three: the authentication algorithm flaw, the LDAP injection and the insecure storage issue.
Progress states that upgrading with the full installer is the only way to remediate these issues, and the upgrade causes a system outage.
Administrators should confirm the current version in the License tab of the MOVEit Transfer Config utility, upgrade versions 2026.0.0–2026.0.3 (18.0.0–18.0.3) to 2026.0.4, upgrade 2025.1.0–2025.1.5 (17.1.0–17.1.5) to 2025.1.6, and move 2025.0.8 (17.0.8) and earlier to an actively supported version.
Security teams must also review logs for unusual sessions, administrative changes and failed logins until patching is complete.
Customers with a current maintenance agreement can download the upgrade from the Progress Community. Others should contact a Progress sales representative or partner. The upgrade documentation is on the Progress docs site.