Patch Forecast
Amber warning
Patch this week.

CVE-2026-89076

Progress Moveit Transfer: SQL injection

Risk score
61/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.5%
Published
14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected
Progress Moveit Transfer before 2025.1.6, 2026.0.4
Fix
Upgrade Progress Moveit Transfer to 2025.1.6 or 2026.0.4 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Progress Moveit TransferTHE FLAWSTHE FIXCVE-2026-89076SQL injectionCVSS 8.8 · EPSS 0%CVE-2026-89068Missing critical step inauthentication vulnerability inProgress MOVEit Transfer…CVSS 9.8 · EPSS 1%CVE-2026-89073Insufficient Session Expirationvulnerability in ProgressMOVEit Transfer. This issue…CVSS 9.8 · EPSS 0%CVE-2026-89067Authentication bypassCVSS 8.8 · EPSS 1%Upgrade Progress Moveit…2025.1.6 · 2026.0.4or later on your release lineWho is exposedProgress Moveit Transferbefore 2025.1.6, 2026.0.4AMBER · PATCH THIS WEEKProgress MoveitTransferMissing critical step inauthentication vulnerability inProgress MOVEit Transfer(LDAP module). This issueaffects MOVEit Transfer:before 2025.1.6 and from2026.0.0 before 2026.0.4.Where it standsNo known exploitationCONNECTS TOSame weaknessSQL injection (CWE-89)399 other warnings in 30 days →Same productEarlier Progress Moveit Transfer warnings8 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Progress Moveit Transfer: Amber, patch this week. Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The flaws

  • CVE-2026-89076: SQL injection (CVSS 8.8 · EPSS 0%)
  • CVE-2026-89068: Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP… (CVSS 9.8 · EPSS 1%)
  • CVE-2026-89073: Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-89067: Authentication bypass (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Progress Moveit Transfer: 2025.1.6 · 2026.0.4 or later on your release line

Who is exposed: Progress Moveit Transfer before 2025.1.6, 2026.0.4

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high

References

Original description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Last activity 14 Oct 2026. Patch Forecast updates every hour.