Progress Software has released fixes for 12 vulnerabilities in MOVEit Transfer, its managed file transfer (MFT) platform. Several of the flaws allow authentication bypass, session hijacking and administrative control.
The company’s September 2026 critical security bulletin, published October 15, 2026, urges customers to upgrade immediately.
MOVEit Transfer vulnerabilities
According to the September 2026 critical security bulletin published by Progress Software, the flaws affect MOVEit Transfer 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3.
Progress says exploitation could lead to unauthorized access, administrative control, data exposure, service instability and resource exhaustion. Reported symptoms include session hijacking, data loss and service interruptions.
All of the CVEs are resolved in versions 2025.1.6 and 2026.0.4. Progress had not reported exploitation in the wild in the bulletin text provided.
| CVE | Weakness | CVSS |
| CVE-2026-89067 | CWE-288 Authentication bypass via alternate path or channel | 8.8 |
| CVE-2026-87093 | CWE-732 Incorrect permission assignment for critical resource | 8.8 |
| CVE-2026-89068 | CWE-304 Missing critical step in authentication | 8.1 |
| CVE-2026-89069 | CWE-79 Cross-site scripting | 8.0 |
| CVE-2026-89074 | CWE-176 Improper handling of Unicode encoding | 7.5 |
| CVE-2026-89070 | CWE-294 Authentication bypass by capture-replay | 7.5 |
| CVE-2026-89077 | CWE-303 Incorrect implementation of authentication algorithm | 7.5 |
| CVE-2026-89073 | CWE-613 Insufficient session expiration | 7.5 |
| CVE-2026-89072 | CWE-863 Incorrect authorization | 7.5 |
| CVE-2026-89071 | CWE-90 LDAP injection | 7.5 |
| CVE-2026-89075 | CWE-922 Insecure storage of sensitive information | 7.3 |
| CVE-2026-89076 | CWE-89 SQL injection | 7.2 |
The two highest-rated flaws, CVE-2026-89067 and CVE-2026-87093, both score 8.8. The first lets an attacker reach protected functions through an alternate path or channel. The second involves incorrect permissions on a critical resource, which can enable privilege escalation.
Several other bugs target authentication directly. They include a missing authentication step, a capture-replay weakness, a flawed authentication algorithm and insufficient session expiration.
Chained together, these could let an attacker take over sessions or gain administrative access. The LDAP and SQL injection flaws add risks of directory manipulation and database exposure.
MOVEit has a troubled history. The 2023 Cl0p campaign exploited a MOVEit SQL injection zero-day and affected thousands of organizations. Defenders should therefore treat any MOVEit authentication flaw as high priority, even without confirmed exploitation.
Researchers credited include Leo Oliver (ssrfer), who reported three of the flaws. Maciej “mace” Nowak of Robert Bosch, Poland, reported two. Matt Grover, Mateusz Mieczkowski and Ryan Vinton each reported one.
The AI-driven platform bugbunny.ai reported three: the authentication algorithm flaw, the LDAP injection and the insecure storage issue.
Progress states that upgrading with the full installer is the only way to remediate these issues, and the upgrade causes a system outage.
Administrators should confirm the current version in the License tab of the MOVEit Transfer Config utility, upgrade versions 2026.0.0–2026.0.3 (18.0.0–18.0.3) to 2026.0.4, upgrade 2025.1.0–2025.1.5 (17.1.0–17.1.5) to 2025.1.6, and move 2025.0.8 (17.0.8) and earlier to an actively supported version.
Security teams must also review logs for unusual sessions, administrative changes and failed logins until patching is complete.
Customers with a current maintenance agreement can download the upgrade from the Progress Community. Others should contact a Progress sales representative or partner. The upgrade documentation is on the Progress docs site.
