CVE-2026-89067
8.8HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-288
Impact
Authenticated attackers can bypass authentication controls to gain unauthorized access and compromise MOVEit Transfer. They need network access and low-privileged account credentials to execute the exploit.
Root cause
An alternate path or channel allows attackers to bypass standard authentication checks.
Affected systems
MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If upgrading immediately is not possible, restrict network access to the web interface to trusted management networks only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.