CVE-2026-89073

Analyzed Analyzed - Analysis Complete

Insufficient Session Expiration in Progress MOVEit Transfer

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: Progress Software Corporation

Description

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-10-15

EPSS Evaluated

2026-11-07

NVD

CVE-2026-89073

EUVD

EUVD-2026-101155

Affected Vendors & Products

Vendor	Product	Version / Range
progress	moveit_transfer	From 2026.0.0 (inc) to 2026.0.4 (exc)
progress	moveit_transfer	to 2025.1.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability is an Insufficient Session Expiration issue in Progress MOVEit Transfer. It allows sessions to remain active longer than they should, potentially letting attackers maintain unauthorized access even after legitimate sessions expire.

Impact Analysis

An attacker could exploit this to maintain persistent access to the system, steal sensitive data, or perform unauthorized actions. The high CVSS score indicates significant impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Update MOVEit Transfer to version 2025.1.6 or later if using versions before 2025.1.6. For versions 2026.0.0 to 2026.0.3, update to 2026.0.4 or later.

Hi! I’m here to help you understand CVE-2026-89073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...