Vulnerability intelligence

CVE-2026-89069

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS Score

High

EPSS — Exploit Probability

0.4%

Riskier than 37% of all CVEs · checked 2026-10-16

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Oct 16, 2026 · latest Oct 16, 2026

Coverage timeline

Progress Patches 12 High Severity Flaws in MOVEit Transfer
securityonline.info · Oct 16, 2026

Related CVEs — Progress

CVE-2026-87093 CVE-2026-89067 CVE-2026-89068 CVE-2026-89070 CVE-2026-89071 CVE-2026-8037KEV CVE-2026-2699 CVE-2026-2701