CVE-2026-89068
8.1HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-304
Impact
Remote, unauthenticated attackers can bypass authentication and gain full unauthorized access to the application via network requests. They need network access to the exposed MOVEit Transfer instance using LDAP authentication.
Root cause
The LDAP module misses a critical validation step during the authentication flow.
Affected systems
Progress MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If patching immediately is not possible, disable LDAP authentication and switch to alternative identity providers or native local accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.