CVE-2026-89075
7.3HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-922
Impact
A local attacker with low privileges can access sensitive stored information and compromise system integrity or availability if a user interacts. They need local access and user interaction to exploit it.
Root cause
MOVEit Transfer insecurely stores sensitive information locally without proper access protections or encryption.
Affected systems
MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. No workaround or interim mitigation is documented; restrict local host access until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.