CVE-2026-89076
7.2HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated high-privilege users can execute arbitrary SQL commands to extract, alter, or delete database contents. Attackers need valid high-privilege credentials and network access to the web interface.
Root cause
Improper input sanitization allows SQL injection via the Custom Reports module.
Affected systems
Progress MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If upgrading cannot happen immediately, restrict access to the MOVEit Transfer web interface and audit high-privilege accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.