CVE-2026-87093: MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MOVEit Transferto a version that resolves this vulnerability.Fixed in 2025.1.6 - Upgrade
Upgrade
Progress MOVEit Transferto a version that resolves this vulnerability.Fixed in 2026.0.4
Event History
Frequently Asked Questions
Which MOVEit Transfer versions should be prioritized for remediation?
Affected versions are those before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. Systems in either range should be updated to the applicable fixed release.
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required; no user interaction is required. Successful exploitation can result in high confidentiality, integrity, and availability impact, with scope changed.