CVE-2026-89072: MOVEit Transfer Authorization Flaw in Certificate Management

The attack vector is network-based and requires low privileges. Exploitation has high attack complexity and does not require user interaction.

A successful exploit could have high impact on confidentiality, integrity, and availability. The reported scope remains unchanged.

Published Oct 14, 2026

Updated

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Affected Software

1 affected component

Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4

Oct 14, 2026

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionSeverityWeakness

The attack vector is network-based and requires low privileges. Exploitation has high attack complexity and does not require user interaction.

A successful exploit could have high impact on confidentiality, integrity, and availability. The reported scope remains unchanged.