Progress MOVEit Transfer: at least 11 CVEs published 14 Oct, led by a Secure Messaging authentication bypass (CVE-2026-89067, CVSS 8.8), an LDAP sign-on bypass and an email MFA bypass; fixed in 2025.1.6 and 2026.0.4

Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).

Product

Progress MOVEit Transfer (managed file transfer server; Secure Messaging, LDAP, OIDC, OAuth, SFTP and Custom Reports modules)

Versions

MOVEit Transfer before 2025.1.6, and 2026.0.0 before 2026.0.4. Fixed: 2025.1.6 and 2026.0.4.

CVSS

8.8 (CVE-2026-89067 and CVE-2026-87093, CVSS 3.1, Progress); 8.1 (CVE-2026-89068); others 7.2–7.5

Exploited in Australia?

unknown

Patch to

Upgrade MOVEit Transfer to 2025.1.6 or 2026.0.4 per Progress's bulletin. Check that MOVEit is not exposed more widely than needed, review LDAP, OIDC, OAuth and email-MFA sign-in settings, and look over recent sign-ins and Secure Messaging activity for anything unexpected.

Primary: Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026) · Vendor: CVE record — CVE-2026-89067 MOVEit Transfer Secure Messaging Authentication Bypass (Progress CNA; 14 Oct 2026) · CVE: CVE-2026-89067, CVE-2026-87093, CVE-2026-89068, CVE-2026-89074, CVE-2026-89070, CVE-2026-89073, CVE-2026-89071, CVE-2026-89072, CVE-2026-89077, CVE-2026-89076, CVE-2026-89075, CVE-2023-34362 · CVE record — CVE-2026-89068 MOVEit Transfer authentication bypass in LDAP sign-on (Progress CNA; 14 Oct 2026)

vulnerabilities identity