CVE-2026-89067CWE-288

CVE-2026-89067

High · published October 14, 2026

CVSS v3.1

8.8

EPSS

Percentile

43.9

In the wild

Unconfirmed

What it is

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00528 · 43.9th percentile
Weakness: CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published: 2026-10-14T20:17Z

Affected products (2)

Product	Versions	Fixed in
progress/moveit_transfer	< 2025.1.6	2025.1.6
progress/moveit_transfer	≥ 2026.0.0, < 2026.0.4	2026.0.4

References (1)

EPSS history

Timeline