CVE-2026-89071CWE-90

CVE-2026-89071

High · published October 14, 2026

CVSS v3.1

7.5

EPSS

Percentile

40.9

In the wild

Unconfirmed

What it is

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00486 · 40.9th percentile
Weakness: CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published: 2026-10-14T20:17Z

Affected products (2)

Product	Versions	Fixed in
progress/moveit_transfer	< 2025.1.6	2025.1.6
progress/moveit_transfer	≥ 2026.0.0, < 2026.0.4	2026.0.4

References (1)

EPSS history

Timeline

16 OCT 03:33Z
EPSS moved — → 0%
epss
14 OCT 15:09Z
MOVEit Transfer LDAP injection in certificate-based authentication
cvelistv5
14 OCT 15:09Z
MOVEit Transfer LDAP injection in certificate-based authentication
cvelistv5