Progress Software has disclosed and patched twelve high-severity vulnerabilities in MOVEit Transfer, its managed file transfer product, including several authentication bypasses. The company published the bulletin and fixed releases on October 14. There is no public proof-of-concept and no confirmed exploitation.
Affected Versions and the Range of Flaw Types
The vulnerabilities affect MOVEit Transfer versions before 2025.1.6, and versions from 2026.0.0 up to but not including 2026.0.4. The twelve flaws span authentication bypass, SQL injection, cross-site scripting and local privilege escalation. Two share the highest score, 8.8.
CVE-2026-89067 and CVE-2026-87093: The Two 8.8-Rated Flaws
CVE-2026-89067 is a low-privilege remote authentication bypass in Secure Messaging. CVE-2026-87093 involves incorrect permissions on service directories and enables local privilege escalation.
Authentication Bypasses Across LDAP, OIDC, SFTP and Client Certificates
Several of the remaining flaws weaken the login path in different components. CVE-2026-89068 (CVSS 8.1) is a missing authentication step in the LDAP module that lets unauthenticated network attackers compromise the server. CVE-2026-89070 (7.5) is a capture-replay authentication bypass in OIDC. CVE-2026-89077 (7.5) involves an incorrect authentication algorithm in SFTP, and CVE-2026-89072 (7.5) is an incorrect authorization issue in Client Certificates.
Injection and Scripting Flaws in Custom Reports, LDAP and Ad Hoc
Three more flaws are injection or scripting issues. CVE-2026-89069 (8.0) is cross-site scripting in Ad Hoc. CVE-2026-89071 (7.5) is LDAP injection. CVE-2026-89076 (7.2) is SQL injection that high-privileged users can trigger in Custom Reports.
Session, Unicode and Data Storage Issues
The last group is made up of session expiration, Unicode handling and insecure data storage flaws, tracked as CVE-2026-89073, CVE-2026-89074 and CVE-2026-89075. The bulletin source does not break these down by severity beyond placing them in the high-severity set.
Which Flaws Need Network Access and Which Need Local or Elevated Rights
The conditions attached to each flaw differ. CVE-2026-89068 in the LDAP module is exploitable by unauthenticated attackers over the network. CVE-2026-89067 is a remote bypass that works from a low-privilege position inside Secure Messaging. CVE-2026-87093 is a local privilege escalation, so it requires access to the server. CVE-2026-89076 requires a high-privileged user, and the cross-site scripting flaw CVE-2026-89069 affects the Ad Hoc component. The mix means that the exposure of any one deployment depends on which components it has enabled, a detail the bulletin source does not spell out.
The 2023 MOVEit Mass Exploitation as Backdrop
Managed file transfer servers remain prime targets for ransomware and extortion operations, and the 2023 mass exploitation of MOVEit Transfer is the backdrop for any new batch of vulnerabilities in the product. No exploitation of the current twelve has been confirmed, and no proof-of-concept is public.
Unpatched servers could allow login bypass or privilege escalation on systems that hold sensitive transferred data. That risk is highest for the LDAP flaw, CVE-2026-89068, because it is described as reachable by unauthenticated attackers over the network, which is a lower bar than the authenticated or local conditions attached to several of the others.
Upgrade Paths and Server Hardening
Progress’s fixed releases are 2025.1.6 and 2026.0.4. Customers should upgrade to the release that matches their version line. Beyond the upgrade, the guidance calls for auditing local server directory permissions, which relates to CVE-2026-87093, and restricting administrative console access to trusted networks.
The spread of the twelve flaws across LDAP, OIDC, SFTP, client certificates and secure messaging shows how many separate authentication routes a file transfer server exposes. A single release resolves all of them, which means administrators who delay the upgrade leave every one of those routes open at once. Progress has not reported any customer impact from the disclosed flaws, and the company published fixed releases on the same day as the bulletin.
