CVE-2026-89071

Undergoing Analysis Undergoing Analysis - In Progress

LDAP Injection in Progress MOVEit Transfer

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89071

EUVD

EUVD-2026-101151

Affected Vendors & Products

Vendor	Product	Version / Range
Progress	MOVEit	Transfer 0
Progress	MOVEit	Transfer 2026.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an LDAP injection vulnerability in Progress MOVEit Transfer's LDAP module. It allows improper neutralization of special elements in LDAP queries, which could let attackers manipulate queries to access unauthorized data or perform unintended actions.

Impact Analysis

An attacker could exploit this to read sensitive data, modify LDAP queries, or gain unauthorized access to the system. This may lead to data breaches, privilege escalation, or further network compromise depending on the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Update Progress MOVEit Transfer to version 2025.1.6 or later if using versions before 2025.1.6. For versions 2026.0.0 to 2026.0.3, update to 2026.0.4 or later.

Hi! I’m here to help you understand CVE-2026-89071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70