Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-89077 (GCVE-0-2026-89077)

Vulnerability from nvd – Published: 2026-10-14 15:16 – Updated: 2026-10-15 03:56

Title

MOVEit Transfer Identity validation flaw in SFTP authentication

Summary

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-303 - Incorrect implementation of authentication algorithm

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:56:58.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "SFTP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "CWE-303 Incorrect implementation of authentication algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:16:24.476Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Identity validation flaw in SFTP authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89077",
    "datePublished": "2026-10-14T15:16:24.476Z",
    "dateReserved": "2026-09-10T18:48:00.974Z",
    "dateUpdated": "2026-10-15T03:56:58.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89076 (GCVE-0-2026-89076)

Vulnerability from nvd – Published: 2026-10-14 15:15 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer SQL injection in custom reporting

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Ryan Vinton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:15.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Custom Reports"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryan Vinton"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Progress MOVEit Transfer (Custom Reports module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Progress MOVEit Transfer (Custom Reports module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:15:23.727Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer SQL injection in custom reporting",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89076",
    "datePublished": "2026-10-14T15:15:23.727Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:15.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89075 (GCVE-0-2026-89075)

Vulnerability from nvd – Published: 2026-10-14 15:14 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer Local Disclosure of Session Information Vulnerability

Summary

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-922 - Insecure Storage of Sensitive Information

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:13.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-922",
              "description": "CWE-922 Insecure Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:14:28.783Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Local Disclosure of Session Information Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89075",
    "datePublished": "2026-10-14T15:14:28.783Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:13.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89074 (GCVE-0-2026-89074)

Vulnerability from nvd – Published: 2026-10-14 15:12 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer Email MFA Bypass

Summary

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-176 - Improper handling of unicode encoding

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:12.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-176",
              "description": "CWE-176 Improper handling of unicode encoding",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:12:49.542Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Email MFA Bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89074",
    "datePublished": "2026-10-14T15:12:49.542Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:12.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89073 (GCVE-0-2026-89073)

Vulnerability from nvd – Published: 2026-10-14 15:11 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Access restriction bypass in OAuth authentication

Summary

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:12.612849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maciej \u0027mace\u0027 Nowak - Cybersecurity Researcher at Robert BOSCH, Poland\u2028https://bugcrowd.com/h/Mace\u2028https://x.com/BalboaMace\u2028https://www.linkedin.com/in/maciej-nowak-522125237/"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:11:30.720Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Access restriction bypass in OAuth authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89073",
    "datePublished": "2026-10-14T15:11:30.720Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T10:31:14.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89072 (GCVE-0-2026-89072)

Vulnerability from nvd – Published: 2026-10-14 15:10 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Authorization Flaw in Certificate Management

Summary

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Mateusz Mieczkowski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:11.930178Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Client Certificates"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz Mieczkowski"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:10:40.581Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Authorization Flaw in Certificate Management",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89072",
    "datePublished": "2026-10-14T15:10:40.581Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89071 (GCVE-0-2026-89071)

Vulnerability from nvd – Published: 2026-10-14 15:09 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer LDAP injection in certificate-based authentication

Summary

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-90 - Improper neutralization of special elements used in an LDAP query ('LDAP injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89071",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:11.247690Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "LDAP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Progress MOVEit Transfer (LDAP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90 Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:09:45.282Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer LDAP injection in certificate-based authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89071",
    "datePublished": "2026-10-14T15:09:45.282Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89070 (GCVE-0-2026-89070)

Vulnerability from nvd – Published: 2026-10-14 15:08 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer OIDC Authentication Replay Vulnerability

Summary

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-294 - Authentication bypass by capture-replay

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:10.546440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "OIDC"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294 Authentication bypass by capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:08:46.009Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer OIDC Authentication Replay Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89070",
    "datePublished": "2026-10-14T15:08:46.009Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89069 (GCVE-0-2026-89069)

Vulnerability from nvd – Published: 2026-10-14 15:07 – Updated: 2026-10-16 15:31

Title

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:25 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Matt Grover

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:25:48.834810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:52.383Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Ad Hoc"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matt Grover"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer (Ad Hoc module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer (Ad Hoc module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:07:00.959Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89069",
    "datePublished": "2026-10-14T15:07:00.959Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-16T15:31:52.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89068 (GCVE-0-2026-89068)

Vulnerability from nvd – Published: 2026-10-14 15:06 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Authentication bypass in LDAP sign-on

Summary

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-304 - Missing critical step in authentication

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:09.860386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "LDAP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-304",
              "description": "CWE-304 Missing critical step in authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:06:13.886Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Authentication bypass in LDAP sign-on",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89068",
    "datePublished": "2026-10-14T15:06:13.886Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89067 (GCVE-0-2026-89067)

Vulnerability from nvd – Published: 2026-10-14 15:05 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Secure Messaging Authentication Bypass

Summary

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-288 - Authentication bypass using an alternate path or channel

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89067",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:09.155363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:15.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:05:26.675Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Secure Messaging Authentication Bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89067",
    "datePublished": "2026-10-14T15:05:26.675Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:15.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87093 (GCVE-0-2026-87093)

Vulnerability from nvd – Published: 2026-10-14 15:04 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Summary

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-15 15:00

Credits

Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87093",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:03.124335Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:15.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maciej \u0027mace\u0027 Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/"
        }
      ],
      "datePublic": "2026-10-15T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:04:16.517Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-87093",
    "datePublished": "2026-10-14T15:04:16.517Z",
    "dateReserved": "2026-09-08T20:07:48.915Z",
    "dateUpdated": "2026-10-15T10:31:15.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15968 (GCVE-0-2026-15968)

Vulnerability from nvd – Published: 2026-07-23 20:01 – Updated: 2026-07-24 13:32

Title

Stored XSS vulnerability in MOVEit Transfer

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 13:32 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T13:32:36.324581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T13:32:48.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T20:01:13.408Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS vulnerability in MOVEit Transfer",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-15968",
    "datePublished": "2026-07-23T20:01:13.408Z",
    "dateReserved": "2026-07-16T15:15:02.130Z",
    "dateUpdated": "2026-07-24T13:32:48.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15967 (GCVE-0-2026-15967)

Vulnerability from nvd – Published: 2026-07-23 19:59 – Updated: 2026-07-25 03:55

Title

MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Summary

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 00:00 UTC

CWE

CWE-613 - Insufficient session expiration

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T03:55:22.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient session expiration vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient session expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient session expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T19:59:33.949Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer refresh-token processing does not enforce updated account restrictions",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-15967",
    "datePublished": "2026-07-23T19:59:33.949Z",
    "dateReserved": "2026-07-16T15:15:01.159Z",
    "dateUpdated": "2026-07-25T03:55:22.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15966 (GCVE-0-2026-15966)

Vulnerability from nvd – Published: 2026-07-23 19:58 – Updated: 2026-07-25 03:55

Title

Improper CORS handling in MOVEit Transfer

Summary

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 00:00 UTC

CWE

CWE-942 - Permissive cross-domain security policy with untrusted domains

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T03:55:21.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942 Permissive cross-domain security policy with untrusted domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T19:58:01.659Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper CORS handling in MOVEit Transfer",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-15966",
    "datePublished": "2026-07-23T19:58:01.659Z",
    "dateReserved": "2026-07-16T15:14:59.993Z",
    "dateUpdated": "2026-07-25T03:55:21.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10697 (GCVE-0-2026-10697)

Vulnerability from nvd – Published: 2026-07-23 19:54 – Updated: 2026-07-25 03:55

Title

MFA Bypass in MOVEit Transfer

Summary

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 00:00 UTC

CWE

CWE-287 - Improper Authentication

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Date Public

2026-07-23 19:52

Credits

Niv Levy

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T03:55:21.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Niv Levy"
        }
      ],
      "datePublic": "2026-07-23T19:52:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Authentication vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T19:54:48.304Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MFA Bypass in MOVEit Transfer",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-10697",
    "datePublished": "2026-07-23T19:54:48.304Z",
    "dateReserved": "2026-06-02T16:42:36.544Z",
    "dateUpdated": "2026-07-25T03:55:21.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89077 (GCVE-0-2026-89077)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:16 – Updated: 2026-10-15 03:56

Title

MOVEit Transfer Identity validation flaw in SFTP authentication

Summary

Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-303 - Incorrect implementation of authentication algorithm

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:56:58.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "SFTP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "CWE-303 Incorrect implementation of authentication algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:16:24.476Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Identity validation flaw in SFTP authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89077",
    "datePublished": "2026-10-14T15:16:24.476Z",
    "dateReserved": "2026-09-10T18:48:00.974Z",
    "dateUpdated": "2026-10-15T03:56:58.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89076 (GCVE-0-2026-89076)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:15 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer SQL injection in custom reporting

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Ryan Vinton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:15.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Custom Reports"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryan Vinton"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Progress MOVEit Transfer (Custom Reports module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Progress MOVEit Transfer (Custom Reports module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:15:23.727Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer SQL injection in custom reporting",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89076",
    "datePublished": "2026-10-14T15:15:23.727Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:15.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89075 (GCVE-0-2026-89075)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:14 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer Local Disclosure of Session Information Vulnerability

Summary

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-922 - Insecure Storage of Sensitive Information

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:13.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-922",
              "description": "CWE-922 Insecure Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:14:28.783Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Local Disclosure of Session Information Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89075",
    "datePublished": "2026-10-14T15:14:28.783Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:13.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89074 (GCVE-0-2026-89074)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:12 – Updated: 2026-10-15 03:57

Title

MOVEit Transfer Email MFA Bypass

Summary

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 00:00 UTC

CWE

CWE-176 - Improper handling of unicode encoding

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:12.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-176",
              "description": "CWE-176 Improper handling of unicode encoding",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:12:49.542Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Email MFA Bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89074",
    "datePublished": "2026-10-14T15:12:49.542Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T03:57:12.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89073 (GCVE-0-2026-89073)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:11 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Access restriction bypass in OAuth authentication

Summary

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:12.612849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maciej \u0027mace\u0027 Nowak - Cybersecurity Researcher at Robert BOSCH, Poland\u2028https://bugcrowd.com/h/Mace\u2028https://x.com/BalboaMace\u2028https://www.linkedin.com/in/maciej-nowak-522125237/"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:11:30.720Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Access restriction bypass in OAuth authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89073",
    "datePublished": "2026-10-14T15:11:30.720Z",
    "dateReserved": "2026-09-10T18:47:56.872Z",
    "dateUpdated": "2026-10-15T10:31:14.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89072 (GCVE-0-2026-89072)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:10 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Authorization Flaw in Certificate Management

Summary

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Mateusz Mieczkowski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:11.930178Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Client Certificates"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz Mieczkowski"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:10:40.581Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Authorization Flaw in Certificate Management",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89072",
    "datePublished": "2026-10-14T15:10:40.581Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89071 (GCVE-0-2026-89071)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:09 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer LDAP injection in certificate-based authentication

Summary

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-90 - Improper neutralization of special elements used in an LDAP query ('LDAP injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

bugbunny.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89071",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:11.247690Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "LDAP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "bugbunny.ai"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Progress MOVEit Transfer (LDAP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90 Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:09:45.282Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer LDAP injection in certificate-based authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89071",
    "datePublished": "2026-10-14T15:09:45.282Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89070 (GCVE-0-2026-89070)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:08 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer OIDC Authentication Replay Vulnerability

Summary

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-294 - Authentication bypass by capture-replay

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:10.546440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "OIDC"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294 Authentication bypass by capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:08:46.009Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer OIDC Authentication Replay Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89070",
    "datePublished": "2026-10-14T15:08:46.009Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89069 (GCVE-0-2026-89069)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:07 – Updated: 2026-10-16 15:31

Title

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:25 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Matt Grover

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:25:48.834810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:52.383Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Ad Hoc"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matt Grover"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer (Ad Hoc module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer (Ad Hoc module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:07:00.959Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89069",
    "datePublished": "2026-10-14T15:07:00.959Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-16T15:31:52.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89068 (GCVE-0-2026-89068)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:06 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Authentication bypass in LDAP sign-on

Summary

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-304 - Missing critical step in authentication

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:09.860386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:14.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "LDAP"
          ],
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-304",
              "description": "CWE-304 Missing critical step in authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:06:13.886Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Authentication bypass in LDAP sign-on",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89068",
    "datePublished": "2026-10-14T15:06:13.886Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:14.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89067 (GCVE-0-2026-89067)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:05 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Secure Messaging Authentication Bypass

Summary

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-288 - Authentication bypass using an alternate path or channel

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-14 15:00

Credits

Leo Oliver (ssrfer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89067",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:09.155363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:15.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leo Oliver (ssrfer)"
        }
      ],
      "datePublic": "2026-10-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:05:26.675Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Secure Messaging Authentication Bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-89067",
    "datePublished": "2026-10-14T15:05:26.675Z",
    "dateReserved": "2026-09-10T18:47:56.871Z",
    "dateUpdated": "2026-10-15T10:31:15.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87093 (GCVE-0-2026-87093)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:04 – Updated: 2026-10-15 10:31

Title

MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Summary

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 03:57 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://community.progress.com/s/article/MOVEit-T…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.6 (semver) Affected: 2026.0.0 , < 2026.0.4 (semver)

Date Public

2026-10-15 15:00

Credits

Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87093",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T03:57:03.124335Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T10:31:15.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.4",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maciej \u0027mace\u0027 Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/"
        }
      ],
      "datePublic": "2026-10-15T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:04:16.517Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-87093",
    "datePublished": "2026-10-14T15:04:16.517Z",
    "dateReserved": "2026-09-08T20:07:48.915Z",
    "dateUpdated": "2026-10-15T10:31:15.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15968 (GCVE-0-2026-15968)

Vulnerability from cvelistv5 – Published: 2026-07-23 20:01 – Updated: 2026-07-24 13:32

Title

Stored XSS vulnerability in MOVEit Transfer

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 13:32 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T13:32:36.324581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T13:32:48.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T20:01:13.408Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS vulnerability in MOVEit Transfer",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-15968",
    "datePublished": "2026-07-23T20:01:13.408Z",
    "dateReserved": "2026-07-16T15:15:02.130Z",
    "dateUpdated": "2026-07-24T13:32:48.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15967 (GCVE-0-2026-15967)

Vulnerability from cvelistv5 – Published: 2026-07-23 19:59 – Updated: 2026-07-25 03:55

Title

MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Summary

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 00:00 UTC

CWE

CWE-613 - Insufficient session expiration

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 78/100 over 141 records in the last 180 days details

References

1 reference

URL	Tags
https://docs.progress.com/bundle/moveit-transfer-…	release-notes

Impacted products

1 product

Vendor	Product	Version
Progress	MOVEit Transfer	Affected: 0 , < 2025.1.5 (semver) Affected: 2026.0.0 , < 2026.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T03:55:22.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MOVEit Transfer",
          "vendor": "Progress",
          "versions": [
            {
              "lessThan": "2025.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2026.0.3",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient session expiration vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient session expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient session expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T19:59:33.949Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MOVEit Transfer refresh-token processing does not enforce updated account restrictions",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-15967",
    "datePublished": "2026-07-23T19:59:33.949Z",
    "dateReserved": "2026-07-16T15:15:01.159Z",
    "dateUpdated": "2026-07-25T03:55:22.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

98 vulnerabilities found for moveit_transfer by progress

CVE-2026-89077 (GCVE-0-2026-89077)

CVE-2026-89076 (GCVE-0-2026-89076)

CVE-2026-89075 (GCVE-0-2026-89075)

CVE-2026-89074 (GCVE-0-2026-89074)

CVE-2026-89073 (GCVE-0-2026-89073)

CVE-2026-89072 (GCVE-0-2026-89072)

CVE-2026-89071 (GCVE-0-2026-89071)

CVE-2026-89070 (GCVE-0-2026-89070)

CVE-2026-89069 (GCVE-0-2026-89069)

CVE-2026-89068 (GCVE-0-2026-89068)

CVE-2026-89067 (GCVE-0-2026-89067)

CVE-2026-87093 (GCVE-0-2026-87093)

CVE-2026-15968 (GCVE-0-2026-15968)

CVE-2026-15967 (GCVE-0-2026-15967)

CVE-2026-15966 (GCVE-0-2026-15966)

CVE-2026-10697 (GCVE-0-2026-10697)

CVE-2026-89077 (GCVE-0-2026-89077)

CVE-2026-89076 (GCVE-0-2026-89076)

CVE-2026-89075 (GCVE-0-2026-89075)

CVE-2026-89074 (GCVE-0-2026-89074)

CVE-2026-89073 (GCVE-0-2026-89073)

CVE-2026-89072 (GCVE-0-2026-89072)

CVE-2026-89071 (GCVE-0-2026-89071)

CVE-2026-89070 (GCVE-0-2026-89070)

CVE-2026-89069 (GCVE-0-2026-89069)

CVE-2026-89068 (GCVE-0-2026-89068)

CVE-2026-89067 (GCVE-0-2026-89067)

CVE-2026-87093 (GCVE-0-2026-87093)

CVE-2026-15968 (GCVE-0-2026-15968)

CVE-2026-15967 (GCVE-0-2026-15967)