CVE-2026-89067

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in Progress MOVEit Transfer

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89067

EUVD

EUVD-2026-101146

Affected Vendors & Products

Vendor	Product	Version / Range
Progress	MOVEit	Transfer 0
Progress	MOVEit	Transfer 2026.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass issue in Progress MOVEit Transfer. It allows attackers to bypass authentication mechanisms by exploiting an alternate path or channel, potentially gaining unauthorized access to the system.

Detection Guidance

Detection requires checking the installed version of Progress MOVEit Transfer. Compare the version against the affected ranges: before 2025.1.6 and from 2026.0.0 before 2026.0.4. Use system commands to verify the installed version, such as checking the application's version in the control panel or via PowerShell.

Impact Analysis

An attacker could exploit this to gain unauthorized access to MOVEit Transfer, leading to data theft, data manipulation, or disruption of services. Systems running affected versions before 2025.1.6 or between 2026.0.0 and 2026.0.4 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access and potential data breaches, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Update MOVEit Transfer to version 2025.1.6 or later if using versions before 2025.1.6, or to 2026.0.4 or later if using versions from 2026.0.0 before 2026.0.4.

Hi! I’m here to help you understand CVE-2026-89067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70