CVE-2026-89069CWE-79cross-site-scripting

CVE-2026-89069

High · published October 14, 2026

CVSS v3.1

8.0

EPSS

Percentile

26.7

In the wild

Unconfirmed

What it is

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The record

Technical detail

CVSS v3.1: 8.0 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00344 · 26.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-10-14T20:17Z

Affected products (2)

Product	Versions	Fixed in
progress/moveit_transfer	< 2025.1.6	2025.1.6
progress/moveit_transfer	≥ 2026.0.0, < 2026.0.4	2026.0.4

References (1)

EPSS history

Timeline

16 OCT 03:33Z
EPSS moved — → 0%
epss
14 OCT 15:07Z
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
cvelistv5
14 OCT 15:07Z
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
cvelistv5