CVE-2026-89077: MOVEit Transfer Identity validation flaw in SFTP authentication
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Affected Software
Event History
Frequently Asked Questions
Which MOVEit Transfer deployments are affected?
Affected releases are those before 2025.1.6, and releases from 2026.0.0 through before 2026.0.4. The issue is in the SFTP module.
What access does an attacker need?
The supplied vector indicates network reachability and low privileges are required. Exploitation has high attack complexity and does not require user interaction.
What version should be deployed to remediate this issue?
Update affected pre-2025.1.6 deployments to 2025.1.6 or later, and affected 2026.0.0 branch deployments to 2026.0.4 or later. The provided data does not identify mitigations for organizations that cannot patch immediately.
What is the potential impact of successful exploitation?
The severity vector rates confidentiality, integrity, and availability impacts as high. The issue is rated high severity with a score of 7.5.