CVE-2026-89075: MOVEit Transfer Local Disclosure of Session Information Vulnerability
Published Oct 14, 2026
·Updated
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
1 affected component
Progress MOVEit Transfer<2025.1.6, >=2026.0.0<2026.0.4
Event History
Oct 14, 2026
CVE Published
via MITRE·03:14 PM
Data Sourced
via MITRE·03:14 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which MOVEit Transfer versions are affected?
Affected versions are releases before 2025.1.6, and versions from 2026.0.0 before 2026.0.4. Deployments outside those stated ranges are not identified as affected by the provided information.
2
Does exploitation require remote network access?
The CVSS vector indicates local access is required. It also indicates that the attacker needs low-level privileges and user interaction to exploit the issue.
3
What is the potential impact if exploitation succeeds?
The CVSS assessment indicates high impact to confidentiality, integrity, and availability. The issue involves insecure storage of sensitive information and can result in disclosure of session information.