CVE-2026-89069
8.0HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-79
Impact
Authenticated attackers can execute arbitrary scripts in a user's browser session, potentially hijacking accounts or compromising data integrity, if they convince a user to interact with malicious content. The attacker requires low-privilege network access and user interaction.
Root cause
Improper input neutralization during web page generation allows cross-site scripting in the Ad Hoc module.
Affected systems
MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If patching immediately is not possible, disable the Ad Hoc module as an interim workaround.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.