CVE-2026-89071
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-90
Impact
Authenticated attackers with network access can execute arbitrary LDAP queries to read or alter directory data and potentially compromise the application. Exploitation requires valid low-privilege credentials and complex query conditions.
Root cause
Improper input sanitization allows LDAP injection within the MOVEit Transfer LDAP module.
Affected systems
MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If upgrading immediately is not possible, disable the LDAP authentication module or restrict network access to trusted management networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.