CVE-2026-89070

HIGH 7.5CVE-2026-89070 · Published 14/10/2026 · updated 19/10/2026

In short

CVE-2026-89070 is a HIGH (CVSS 7.5) vulnerability affecting moveit transfer (progress).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.2% of all vulnerabilities.
Fix: update to 2026.0.4, 2025.1.6 or later.

Package	Affected versions	Patched versions
moveit transfer progress	`≥ 2026.0.0, < 2026.0.4< 2025.1.6`	`2026.0.42025.1.6`

Description

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

References

community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026 · Vendor Advisory

More vulnerabilities in moveit transfer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moveit transfer

progress

≥ 2026.0.0, < 2026.0.4< 2025.1.6

2026.0.42025.1.6

More vulnerabilities in moveit transfer

See all →