CVE-2026-89068: MOVEit Transfer Authentication bypass in LDAP sign-on
Published Oct 14, 2026
·Updated
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
1 affected component
Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4
Event History
Oct 14, 2026
CVE Published
via MITRE·03:06 PM
Data Sourced
via MITRE·03:06 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which MOVEit Transfer deployments are affected?
Affected deployments are those using the LDAP module for sign-on and running a version before 2025.1.6, or a 2026.0.0 release before 2026.0.4.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-based exploitation with no required privileges or user interaction. Exploitation is rated high complexity.