progress MOVEit Transfer vulnerabilities

Latest progress MOVEit Transfer CVEs

Newest publication first · page 1 of 2

1. CVE-2026-89077 MOVEit Transfer Identity validation flaw in SFTP authentication

   Published 2026-10-14

   High·CVSS 7.5

   Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

2. CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting

   Published 2026-10-14

   High·CVSS 7.2

   Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

3. CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability

   Published 2026-10-14

   High·CVSS 7.3

   Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

4. CVE-2026-89074 MOVEit Transfer Email MFA Bypass

   Published 2026-10-14

   High·CVSS 7.5

   Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

5. CVE-2026-89073 MOVEit Transfer Access restriction bypass in OAuth authentication

   Published 2026-10-14

   High·CVSS 7.5

   Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

6. CVE-2026-89072 MOVEit Transfer Authorization Flaw in Certificate Management

   Published 2026-10-14

   High·CVSS 7.5

   Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

7. CVE-2026-89071 MOVEit Transfer LDAP injection in certificate-based authentication

   Published 2026-10-14

   High·CVSS 7.5

   Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

8. CVE-2026-89070 MOVEit Transfer OIDC Authentication Replay Vulnerability

   Published 2026-10-14

   High·CVSS 7.5

   Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

9. CVE-2026-89069 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

   Published 2026-10-14

   High·CVSS 8.0

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

10. CVE-2026-89068 MOVEit Transfer Authentication bypass in LDAP sign-on

    Published 2026-10-14

    High·CVSS 8.1

    Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

11. CVE-2026-89067 MOVEit Transfer Secure Messaging Authentication Bypass

    Published 2026-10-14

    High·CVSS 8.8

    Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

12. CVE-2026-87093 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

    Published 2026-10-14

    High·CVSS 8.8

    Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

13. CVE-2026-15968 Stored XSS vulnerability in MOVEit Transfer

    Published 2026-07-23

    High·CVSS 7.1

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

14. CVE-2026-15967 MOVEit Transfer refresh-token processing does not enforce updated account restrictions

    Published 2026-07-23

    High·CVSS 7.5

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

15. CVE-2026-15966 Improper CORS handling in MOVEit Transfer

    Published 2026-07-23

    High·CVSS 7.5

    Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

16. CVE-2026-10697 MFA Bypass in MOVEit Transfer

    Published 2026-07-23

    High·CVSS 7.5

    Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

17. CVE-2026-8801 File Extension Restriction Bypass in MOVEit Transfer

    Published 2026-07-08

    Low·CVSS 3.5

    Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

18. CVE-2026-8800 Cross-Org External Token Metadata accessible to AuditUser role

    Published 2026-07-08

    Low·CVSS 2.7

    Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

19. CVE-2026-8651 IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer

    Published 2026-07-08

    Low·CVSS 3.7

    Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

20. CVE-2026-8650 Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

    Published 2026-07-08

    Medium·CVSS 4.5

    Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

21. CVE-2026-8649 Institution scope bypass vulnerability in custom reports

    Published 2026-07-08

    Medium·CVSS 6.4

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

22. CVE-2026-11903 Stored XSS in MOVEit Transfer Ad Hoc module

    Published 2026-07-08

    High·CVSS 8.0

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

23. CVE-2026-10699 Memory leak in SFTP service can result in a denial of service in MOVEit Transfer

    Published 2026-07-08

    High·CVSS 7.5

    Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

24. CVE-2026-10698 Table scope bypass vulnerability in custom reports

    Published 2026-07-08

    High·CVSS 7.2

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

25. CVE-2025-11235 MOVEit Transfer REST API does not require current password in order to initiate the password change process

    Published 2026-01-06

    Low·CVSS 3.7

    Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.