CVE-2026-89074: MOVEit Transfer Email MFA Bypass

Q: Which deployments are affected?

Progress MOVEit Transfer versions before 2025.1.6 are affected, as are versions from 2026.0.0 before 2026.0.4.

Q: What level of access does an attacker need?

The vulnerability is network-reachable and requires low privileges. It does not require user interaction, but exploitation has high attack complexity.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can result in high impacts to confidentiality, integrity, and availability.

Published Oct 14, 2026

Updated

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Affected Software

1 affected component

Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4

Event History

Oct 14, 2026

CVE Published

via MITRE·03:12 PM

Data Sourced

via MITRE·03:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Progress MOVEit Transfer versions before 2025.1.6 are affected, as are versions from 2026.0.0 before 2026.0.4.

What level of access does an attacker need?

The vulnerability is network-reachable and requires low privileges. It does not require user interaction, but exploitation has high attack complexity.

What is the potential impact if exploitation succeeds?