CVE-2026-89073: MOVEit Transfer Access restriction bypass in OAuth authentication
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MOVEit Transferto a version that resolves this vulnerability.Fixed in 2025.1.6 - Upgrade
Upgrade
Progress MOVEit Transferto a version that resolves this vulnerability.Fixed in 2026.0.4
Event History
Frequently Asked Questions
Which MOVEit Transfer versions are affected?
Affected versions are those before 2025.1.6, and versions from 2026.0.0 before 2026.0.4.
Does exploitation require an authenticated account or user interaction?
The supplied CVSS vector indicates no privileges are required (PR:N), but user interaction is required (UI:R). Exploitation is network-accessible (AV:N) and has high complexity (AC:H).
What is the potential impact if the issue is exploited?
The CVSS vector rates confidentiality, integrity, and availability impact as high (C:H/I:H/A:H). The scope is unchanged (S:U).