CVE-2026-89070
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-294
Impact
Attackers can bypass authentication to gain full access to MOVEit Transfer by capturing and replaying OIDC authentication tokens. This requires network access and user interaction to intercept the session.
Root cause
The OIDC module fails to properly validate or invalidate captured authentication tokens, allowing capture-replay attacks.
Affected systems
Progress MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If patching immediately is not possible, disable the OIDC authentication module.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.