CVE-2026-89070: MOVEit Transfer OIDC Authentication Replay Vulnerability
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
MOVEit Transfer deployments using the OIDC module are affected if they run a version before 2025.1.6, or a 2026.0.0 release before 2026.0.4.
What does an attacker need to exploit this issue?
The CVSS vector indicates network access and user interaction are required, while no prior privileges are required. Exploitation is assessed as high complexity and involves capture-replay of authentication material.
What versions address the issue?
The affected version ranges end at 2025.1.6 and 2026.0.4. Organizations should identify MOVEit Transfer instances in the listed affected ranges and move to the applicable fixed release.
How can we identify potentially affected systems?
Inventory MOVEit Transfer versions and determine whether the OIDC module is in use. Systems running before 2025.1.6, or 2026.0.0 through before 2026.0.4, should be treated as potentially affected.