PROGRESS Software disclosed twelve high-severity MOVEit Transfer vulnerabilities on 14 October 2026. The flaws span multiple core components including LDAP, OIDC, SFTP, Ad Hoc, Custom Reports, and Client Certificates, and could enable authentication bypass, privilege escalation, cross-site scripting, and SQL injection across MOVEit Transfer deployments. The highest CVSS v3.1 base score is 8.8 for CVE-2026-87093 and CVE-2026-89067.
Progress notes that there is no public proof-of-concept and no active exploitation in the wild has been confirmed at this time. Affected systems are MOVEit Transfer versions prior to 2025.1.6 and 2026.0.0 up to but not including 2026.0.4; versions 2025.1.6 and 2026.0.4 are not affected.
Twelve CVEs are listed, including CVE-2026-89068 (8.1), CVE-2026-89069 (8.0), CVE-2026-89070 (7.5), CVE-2026-89071 (7.5), CVE-2026-89072 (7.5), CVE-2026-89073 (7.5), CVE-2026-89074 (unspecified CVSS), CVE-2026-89075, CVE-2026-89076 (7.2), and CVE-2026-89077 noted in the narrative. The report attributes exploitation potential to bypass login controls, privilege elevation, LDAP injection, XSS, SQL injection in Custom Reports, and improper session handling among others.
Progress has released fixes in MOVEit Transfer versions 2025.1.6 and 2026.0.4; administrators are urged to upgrade immediately and audit local directory permissions while restricting admin console access to trusted networks.