Threat reportVulnerabilityTL-2026-3821
Progress MOVEit Transfer: 12 vulnerabilities incl. authentication bypass and privilege escalation (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068 and 9 more)
Progress MOVEit Transfer (TL-2026-3821), also tracked as MOVEit Transfer Critical Security Bulletin (September 2026), is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-17. It has no confirmed attribution, affects Progress Software MOVEit Transfer, references 12 CVEs (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068), maps to 8 MITRE ATT&CK techniques (T1059.007, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 12Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3821
- Threat ID
- TL-2026-3821
- Also known as
- MOVEit Transfer Critical Security Bulletin (September 2026)
- Severity
- HIGH
- CVSS
- 8.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How Progress MOVEit Transfer works
Progress Software disclosed 12 MOVEit Transfer vulnerabilities (CVSS 7.2-8.8) covering authentication bypass, incorrect permission assignment, missing authentication, XSS, LDAP injection and SQL injection. Affected: 2025.0.8 and earlier, 2025.1.0-2025.1.5, 2026.0.0-2026.0.3; fixed in 2025.1.6 and 2026.0.4. Progress had not reported exploitation in the wild.
Progress Software published its MOVEit Transfer Critical Security Bulletin (September 2026) on 2026-10-15, addressing 12 vulnerabilities in the MOVEit Transfer managed file transfer platform. The CVEs were published to NVD-fed trackers on 2026-10-14. CVSS v3.1 base scores range from 7.2 to 8.8; the two highest (8.8) are CVE-2026-89067 (authentication bypass using an alternate path or channel, CWE-288) and CVE-2026-87093 (incorrect permission assignment for a critical resource, CWE-732).
The remaining flaws are: CVE-2026-89068 (8.1, missing critical step in authentication, CWE-304); CVE-2026-89069 (8.0, cross-site scripting, CWE-79); CVE-2026-89074 (7.5, improper handling of Unicode encoding, CWE-176); CVE-2026-89070 (7.5, authentication bypass by capture-replay, CWE-294); CVE-2026-89077 (7.5, incorrect implementation of authentication algorithm, CWE-303); CVE-2026-89073 (7.5, insufficient session expiration, CWE-613); CVE-2026-89072 (7.5, incorrect authorization, CWE-863); CVE-2026-89071 (7.5, LDAP injection, CWE-90); CVE-2026-89075 (7.3, insecure storage of sensitive information, CWE-922; vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H); and CVE-2026-89076 (7.2, SQL injection, CWE-89). Per-CVE attack vectors other than CVE-2026-89075 were not stated in the sources reviewed.
Affected versions are MOVEit Transfer 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3. Fixed releases are 2025.1.6 and 2026.0.4. Per the source, exploitation could lead to unauthorized access, administrative control, data exposure, service instability and resource exhaustion, with symptoms such as session hijacking, data loss and service interruption. Progress states that upgrading with the full installer is the only way to remediate, and that the upgrade causes a system outage.
No in-the-wild exploitation has been reported by Progress, no public PoC and no threat actor or network/file IOCs are identified in the sources; Feedly lists EPSS for CVE-2026-89075 at 0.17%. Context: MOVEit has a history of mass exploitation, notably the 2023 Cl0p campaign abusing a SQL injection zero-day (CVE-2023-34362), and Progress issued earlier 2026 bulletins (June and July 2026) for other MOVEit Transfer flaws, so defenders should treat MOVEit patch cycles as high priority. Researchers credited include Leo Oliver (ssrfer), Maciej Nowak (Robert Bosch, Poland), Matt Grover, Mateusz Mieczkowski, Ryan Vinton and bugbunny.ai.
MITRE ATT&CK techniques used in TL-2026-3821
Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials
Collection
T1213 Data from Information Repositories
Lateral Movement
T1550.004 Use Alternate Authentication Material: Web Session Cookie
Affected products and versions in Progress MOVEit Transfer
- Progress Software — MOVEit Transfer
Vulnerable versions: 2025.0.8 and earlier; 2025.1.0 - 2025.1.5; 2026.0.0 - 2026.0.3
Fixed in: 2025.1.6; 2026.0.4
Remediation for Progress MOVEit Transfer
Patches
- MOVEit Transfer 2025.1.6
- MOVEit Transfer 2026.0.4
Immediate actions
- Upgrade MOVEit Transfer to 2025.1.6 or 2026.0.4 using the full installer (the upgrade causes a system outage; schedule a maintenance window)
- Review MOVEit Transfer authentication, admin and session logs for anomalous logins, privilege changes and unexpected admin activity
Workarounds
- Progress states upgrading with the full installer is the only way to remediate; no workaround was identified in the sources
Longer-term hardening
- Restrict MOVEit web interface exposure to required networks and place it behind a WAF/reverse proxy
- Subscribe to Progress security bulletins; MOVEit has had repeated 2026 bulletins (June, July, September)
CVEs associated with Progress MOVEit Transfer
CVE-2026-89067, CVE-2026-87093, CVE-2026-89068, CVE-2026-89069, CVE-2026-89074, CVE-2026-89070, CVE-2026-89077, CVE-2026-89073, CVE-2026-89072, CVE-2026-89071, CVE-2026-89075, CVE-2026-89076
Weaknesses (CWE) in Progress MOVEit Transfer
CWE-288, CWE-732, CWE-304, CWE-79, CWE-176, CWE-294, CWE-303, CWE-613, CWE-863, CWE-90
Timeline of Progress MOVEit Transfer
- Historical context: Progress disclosed the MOVEit Transfer SQL injection zero-day (CVE-2023-34362) exploited by the Cl0p campaign, which affected thousands of organizations.
- Canadian Cyber Centre AV26-678 flagged the Progress MOVEit Transfer Critical Security Bulletin for June 2026 (CVE-2026-10698, CVE-2026-10699, CVE-2026-11903).
- Progress published security advisories fixing MOVEit Transfer issues in 2025.1.5 and 2026.0.3 (Canadian Cyber Centre AV26-746, 2026-07-24).
- Further MOVEit Transfer XSS and security-policy-bypass CVEs (CVE-2026-10697, CVE-2026-15966/15967/15968) fixed in 2026.0.3 were reported, with no sign of active exploitation.
- The 12 CVEs (e.g. CVE-2026-89075) were published, affecting versions before 2025.1.6 and 2026.0.0 before 2026.0.4.
- Progress published the MOVEit Transfer Critical Security Bulletin (September 2026) with fixes in 2025.1.6 and 2026.0.4.
- GBHackers reported the 12 vulnerabilities, noting Progress had not reported exploitation in the wild.
Sources cited for Progress MOVEit Transfer
- Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation (GBHackers)
- CVE-2026-89075 (Feedly CVE tracker)
- Multiple Vulnerabilities in MOVEit Transfer (ADGM advisory)
- Progress security advisory AV26-746 (Canadian Centre for Cyber Security) - prior July 2026 MOVEit fixes
- Progress security advisory AV26-678 (Canadian Centre for Cyber Security) - prior June 2026 MOVEit bulletin
- MOVEit Transfer vulnerabilities, July 2026 (CraftedSignal brief)
- MOVEit Transfer Critical Security Bulletin - June 2026 (Progress Community)
- MOVEit Transfer 2026 Release Notes - Fixed Issues in 2026.0.3
Detection coverage for TL-2026-3821
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3821 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.