Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-89072

Progress Moveit Transfer: incorrect authorisation

Risk score
56/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.2%
Published
14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected
Progress Moveit Transfer before 2025.1.6, 2026.0.4
Fix
Upgrade Progress Moveit Transfer to 2025.1.6 or 2026.0.4 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Progress Moveit TransferTHE FLAWSTHE FIXCVE-2026-89072Incorrect authorisationCVSS 8.8 · EPSS 0%CVE-2026-89068Missing critical step inauthentication vulnerability inProgress MOVEit Transfer…CVSS 9.8 · EPSS 1%CVE-2026-89073Insufficient Session Expirationvulnerability in ProgressMOVEit Transfer. This issue…CVSS 9.8 · EPSS 0%CVE-2026-89067Authentication bypassCVSS 8.8 · EPSS 1%Upgrade Progress Moveit…2025.1.6 · 2026.0.4or later on your release lineWho is exposedProgress Moveit Transferbefore 2025.1.6, 2026.0.4AMBER · PATCH THIS WEEKProgress MoveitTransferMissing critical step inauthentication vulnerability inProgress MOVEit Transfer(LDAP module). This issueaffects MOVEit Transfer:before 2025.1.6 and from2026.0.0 before 2026.0.4.Where it standsNo known exploitationCONNECTS TOSame weaknessIncorrect authorisation (CWE-863)336 other warnings in 30 days →Same productEarlier Progress Moveit Transfer warnings8 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Progress Moveit Transfer: Amber, patch this week. Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The flaws

  • CVE-2026-89072: Incorrect authorisation (CVSS 8.8 · EPSS 0%)
  • CVE-2026-89068: Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP… (CVSS 9.8 · EPSS 1%)
  • CVE-2026-89073: Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-89067: Authentication bypass (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Progress Moveit Transfer: 2025.1.6 · 2026.0.4 or later on your release line

Who is exposed: Progress Moveit Transfer before 2025.1.6, 2026.0.4

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.8 high

References

Original description

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Last activity 14 Oct 2026. Patch Forecast updates every hour.