CVE-2026-89072
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-863
Impact
Authenticated attackers can bypass access controls to access unauthorized data or perform unauthorized actions. They need a low-privileged account and network access to the MOVEit Transfer application.
Root cause
The Client Certificates module fails to properly enforce authorization checks.
Affected systems
Progress MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If upgrading immediately is not possible, disable the Client Certificates module if it is not strictly required.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.