CVE-2026-89077
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-303
Impact
Low-privileged network attackers can bypass SFTP authentication to achieve full compromise of MOVEit Transfer. They need network access to the SFTP service and valid low-level credentials to exploit the flaw.
Root cause
The SFTP module incorrectly implements its authentication algorithm.
Affected systems
Progress MOVEit Transfer before 2025.1.6, and versions 2026.0.0 through 2026.0.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to MOVEit Transfer 2025.1.6, 2026.0.4, or later. If patching immediately is not possible, disable the SFTP service or restrict network access to trusted IP addresses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.