CVE-2026-89073
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-613
Impact
Attackers can hijack user sessions to read, modify, or delete sensitive data and take over accounts. They need network access and must convince an authenticated user to perform an action that exposes their session.
Root cause
The application fails to properly expire user sessions after logout or inactivity.
Affected systems
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade MOVEit Transfer to version 2025.1.6, 2026.0.4, or later. If patching immediately is not possible, enforce aggressive idle session timeout limits in the web admin interface.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.