CVE-2026-89069: MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
Published Oct 14, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
1 affected component
Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4
Event History
Oct 14, 2026
CVE Published
via MITRE·03:07 PM
Data Sourced
via MITRE·03:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
The issue affects Progress MOVEit Transfer instances using the Ad Hoc module when running versions earlier than 2025.1.6, or versions from 2026.0.0 through earlier than 2026.0.4.
2
What access does an attacker need?
The vector is network-accessible, but exploitation requires low-privileged access and user interaction. The vulnerable functionality is in the Ad Hoc module.
3
What could successful exploitation allow?
Successful stored XSS exploitation can impact confidentiality, integrity, and availability at a high level.