CVE-2026-89067: MOVEit Transfer Secure Messaging Authentication Bypass
Published Oct 14, 2026
·Updated
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
1 affected component
Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4
Event History
Oct 14, 2026
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which MOVEit Transfer deployments are affected?
Affected versions are those before 2025.1.6, and versions from 2026.0.0 before 2026.0.4. Deployments outside those stated version ranges are not identified as affected by the provided information.
2
What level of access does an attacker need?
The CVSS vector indicates network-reachable exploitation with low attack complexity, no user interaction, and low privileges required. Successful exploitation can affect confidentiality, integrity, and availability.