Progress patches 12 MOVEit flaws enabling authentication bypass and privilege escalation
Progress Software released fixes for 12 vulnerabilities in its MOVEit Transfer platform, urging immediate upgrades to prevent unauthorized access and session hijacking.
Key points
- Twelve vulnerabilities, including two high-severity flaws, allow authentication bypass and administrative control in MOVEit Transfer.
- Progress Software published a critical security bulletin on October 15, 2026, detailing the issues and required remediation steps.
- Affected versions include those prior to 2025.1.6 and the 2026.0.0 through 2026.0.3 series, with fixes available in specific updated releases.
Progress Software has released patches for twelve vulnerabilities in its MOVEit Transfer managed file transfer platform. The company published a critical security bulletin on October 15, 2026, urging customers to upgrade immediately to address flaws that could allow attackers to bypass authentication and gain administrative control.
At a glance
- CVE
- CVE-2026-89067
- Product
- Progress MOVEit Transfer
- CVSS
- 8.8 High
- Weakness
- authentication bypass
- Exploited
- No known exploitation
The vulnerabilities affect multiple versions of the software, specifically MOVEit Transfer 2025.0.8 and earlier, the 2025.1.0 through 2025.1.5 range, and the 2026.0.0 through 2026.0.3 series. According to the NVD record, CVE-2026-89067 is rated High with a CVSS score of 8.8 and involves an authentication bypass using an alternate path. Progress states that all twelve CVEs are resolved in versions 2025.1.6 and 2026.0.4.
Technical Details and Impact
Two flaws, CVE-2026-89067 and CVE-2026-87093, both carry a CVSS score of 8.8. The first allows attackers to reach protected functions through an alternate channel, while the second involves incorrect permissions on a critical resource that can enable privilege escalation. Several other bugs target authentication mechanisms directly, including a missing authentication step, a capture-replay weakness, a flawed authentication algorithm, and insufficient session expiration.
When chained together, these authentication flaws could allow an attacker to hijack sessions or gain administrative access. The bulletin also notes LDAP and SQL injection flaws, which add risks of directory manipulation and database exposure. Reported symptoms of exploitation include session hijacking, data loss, service interruptions, and resource exhaustion.
Researcher Credits and History
Several security researchers and tools contributed to identifying these flaws. Leo Oliver, known as ssrfer, reported three of the vulnerabilities. Maciej “mace” Nowak of Robert Bosch in Poland reported two. Matt Grover, Mateusz Mieczkowski, and Ryan Vinton each reported one flaw. Additionally, the AI-driven platform bugbunny.ai reported three issues: the authentication algorithm flaw, the LDAP injection, and an insecure storage issue.
MOVEit has a history of significant security incidents. In 2023, the Cl0p campaign exploited a MOVEit SQL injection zero-day, affecting thousands of organizations. Because of this history, defenders should treat any MOVEit authentication flaw as a high priority, even though Progress has not reported confirmed exploitation in the wild for these specific vulnerabilities.
What should you do?
Progress states that upgrading with the full installer is the only way to remediate these issues. The upgrade process causes a system outage, so organizations should plan maintenance windows accordingly. Customers should verify their current version against the affected list and apply the updates to 2025.1.6 or 2026.0.4 as soon as possible.
What to do and how to stay safe: Progress MOVEit Transfer
- Inventory your environment to identify any installations of MOVEit Transfer versions 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, or 2026.0.0 through 2026.0.3.
- Schedule a maintenance window to apply the full installer update to versions 2025.1.6 or 2026.0.4, acknowledging that the process will cause a service outage.
- Monitor logs for signs of session hijacking, unusual administrative activity, or service interruptions that could indicate exploitation of authentication bypass flaws.
- Review access controls and session management policies to mitigate risks associated with the identified authentication and session expiration weaknesses.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MOVEit Transfer versions are affected by these vulnerabilities?
Versions 2025.0.8 and earlier, 2025.1.0 through 2025.1.5, and 2026.0.0 through 2026.0.3 are affected. Fixes are available in versions 2025.1.6 and 2026.0.4.
Is there confirmed evidence of exploitation in the wild?
Progress has not reported exploitation in the wild in its October 15, 2026 security bulletin, though the flaws allow for significant unauthorized access.
What is the most severe vulnerability in this batch?
CVE-2026-89067 and CVE-2026-87093 are the most severe, both scoring 8.8 (High) on the CVSS scale.
