CVE-2026-87093
8.8HighPublished 14 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-732
Impact
Local attackers with an existing account can escalate privileges across security boundaries and fully compromise host confidentiality, integrity, and availability. They need local system access or execution capabilities to exploit this.
Root cause
Critical resources are configured with incorrect permission assignments.
Affected systems
MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade MOVEit Transfer to version 2025.1.6, 2026.0.4, or newer; vendor mitigation details are not specified in the advisory, so isolate host access until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.