CVE-2026-89074
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-176
Impact
Authenticated attackers can compromise MOVEit Transfer integrity, confidentiality, and availability over the network. They need valid user credentials and must satisfy complex attack conditions.
Root cause
The application improperly handles Unicode encoding, leading to unexpected input processing.
Affected systems
Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If upgrading immediately is not possible, restrict access to the web interface to trusted internal IP addresses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.