CVE-2026-89071: MOVEit Transfer LDAP injection in certificate-based authentication
Published Oct 14, 2026
·Updated
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
1 affected component
Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4
Event History
Oct 14, 2026
CVE Published
via MITRE·03:09 PM
Data Sourced
via MITRE·03:09 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Affected deployments are Progress MOVEit Transfer instances using the LDAP module on versions before 2025.1.6, or versions from 2026.0.0 before 2026.0.4.
2
What level of access does an attacker need?
The severity vector indicates that an attacker needs low privileges and can exploit the issue remotely without user interaction. Exploitation has high complexity.
3
What is the security impact of successful exploitation?
Successful exploitation can have high impact on confidentiality, integrity, and availability.