CVE-2026-89077
Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in Progress MOVEit Transfer

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-89077
EUVD
EUVD-2026-101160

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress MOVEit Transfer 0
Progress MOVEit Transfer 2026.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is due to incorrect implementation of an authentication algorithm in the SFTP module of Progress MOVEit Transfer. It affects specific versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Impact Analysis

An attacker could exploit this to bypass authentication, gain unauthorized access, and perform actions with elevated privileges. This may lead to data theft, modification, or disruption of services.

Compliance Impact

The vulnerability in Progress MOVEit Transfer's SFTP module could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR and HIPAA. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. Exploitation of this flaw could result in non-compliance due to potential data exposure or loss.

Mitigation Strategies

Update MOVEit Transfer to version 2025.1.6 or later if using versions before 2025.1.6, or to version 2026.0.4 or later if using versions from 2026.0.0 before 2026.0.4.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart