# Progress MOVEit Transfer: 12 vulnerabilities incl. authentication bypass and privilege escalation (CVE-2026-89067, CVE-2026-87093, CVE-2026-89068 and 9 more)

> Progress Software disclosed 12 MOVEit Transfer vulnerabilities (CVSS 7.2-8.8) covering authentication bypass, incorrect permission assignment, missing authentication, XSS, LDAP injection and SQL injection. Affected: 2025.0.8 and earlier, 2025.1.0-2025.1.5, 2026.0.0-2026.0.3; fixed in 2025.1.6 and 2026.0.4. Progress had not reported exploitation in the wild.

- **Published:** 2026-10-17T16:23:20Z
- **Last reviewed:** 2026-10-17T16:23:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3821
- **ID:** TL-2026-3821
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-89067, CVE-2026-87093, CVE-2026-89068, CVE-2026-89069, CVE-2026-89074, CVE-2026-89070, CVE-2026-89077, CVE-2026-89073, CVE-2026-89072, CVE-2026-89071, CVE-2026-89075, CVE-2026-89076

## Description

Progress Software published its MOVEit Transfer Critical Security Bulletin (September 2026) on 2026-10-15, addressing 12 vulnerabilities in the MOVEit Transfer managed file transfer platform. The CVEs were published to NVD-fed trackers on 2026-10-14. CVSS v3.1 base scores range from 7.2 to 8.8; the two highest (8.8) are CVE-2026-89067 (authentication bypass using an alternate path or channel, CWE-288) and CVE-2026-87093 (incorrect permission assignment for a critical resource, CWE-732).

The remaining flaws are: CVE-2026-89068 (8.1, missing critical step in authentication, CWE-304); CVE-2026-89069 (8.0, cross-site scripting, CWE-79); CVE-2026-89074 (7.5, improper handling of Unicode encoding, CWE-176); CVE-2026-89070 (7.5, authentication bypass by capture-replay, CWE-294); CVE-2026-89077 (7.5, incorrect implementation of authentication algorithm, CWE-303); CVE-2026-89073 (7.5, insufficient session expiration, CWE-613); CVE-2026-89072 (7.5, incorrect authorization, CWE-863); CVE-2026-89071 (7.5, LDAP injection, CWE-90); CVE-2026-89075 (7.3, insecure storage of sensitive information, CWE-922; vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H); and CVE-2026-89076 (7.2, SQL injection, CWE-89). Per-CVE attack vectors other than CVE-2026-89075 were not stated in the sources reviewed.

Affected versions are MOVEit Transfer 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3. Fixed releases are 2025.1.6 and 2026.0.4. Per the source, exploitation could lead to unauthorized access, administrative control, data exposure, service instability and resource exhaustion, with symptoms such as session hijacking, data loss and service interruption. Progress states that upgrading with the full installer is the only way to remediate, and that the upgrade causes a system outage.

No in-the-wild exploitation has been reported by Progress, no public PoC and no threat actor or network/file IOCs are identified in the sources; Feedly lists EPSS for CVE-2026-89075 at 0.17%. Context: MOVEit has a history of mass exploitation, notably the 2023 Cl0p campaign abusing a SQL injection zero-day (CVE-2023-34362), and Progress issued earlier 2026 bulletins (June and July 2026) for other MOVEit Transfer flaws, so defenders should treat MOVEit patch cycles as high priority. Researchers credited include Leo Oliver (ssrfer), Maciej Nowak (Robert Bosch, Poland), Matt Grover, Mateusz Mieczkowski, Ryan Vinton and bugbunny.ai.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1539 Steal Web Session Cookie
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1213 Data from Information Repositories

## Sources

- [Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation (GBHackers)](https://gbhackers.com/moveit-transfer-security-flaws/)
- [CVE-2026-89075 (Feedly CVE tracker)](https://feedly.com/cve/CVE-2026-89075)
- [Multiple Vulnerabilities in MOVEit Transfer (ADGM advisory)](https://assets.adgm.com/download/assets/432319277+-+Multiple+Vulnerabilities+in+MOVEit+Transfer.pdf/ef57b68c7e7711f19cc1da66bf76d469)
- [Progress security advisory AV26-746 (Canadian Centre for Cyber Security) - prior July 2026 MOVEit fixes](https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-746)
- [Progress security advisory AV26-678 (Canadian Centre for Cyber Security) - prior June 2026 MOVEit bulletin](https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-678)
- [MOVEit Transfer vulnerabilities, July 2026 (CraftedSignal brief)](https://feed.craftedsignal.io/briefs/2026-07-moveit-vulnerabilities/)
- [MOVEit Transfer Critical Security Bulletin - June 2026 (Progress Community)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026)
- [MOVEit Transfer 2026 Release Notes - Fixed Issues in 2026.0.3](https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3821