Read the docs
TI-2026-74044 Aliases CVE-2026-89073GHSA-vwr9-5p5q-ghvv

Access restriction bypass in Progress MOVEit Transfer OAuth authentication

Priority MEDIUM 43CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-613.

Summary

Progress MOVEit Transfer is affected from 0 before 2025.1.6 and from 2026.0.0 before 2026.0.4. Insufficient session expiration (CWE-613) lets sessions remain valid when they should have expired, which allows an attacker to bypass access restrictions in OAuth authentication. The flaw can be exploited remotely without authentication or user interaction, and it has a CVSS 3.1 base score of 9.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.004 34th percentileScored 2026-11-07
Fix Fixed MOVEit Transfer (Progress): 2025.1.6, 2026.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressMOVEit Transferbefore 2025.1.6; 2026.0.0 to before 2026.0.42025.1.6, 2026.0.4Patch availableCNA
  • MOVEit Transfer VendorProgress Affected before 2025.1.6; 2026.0.0 to before 2026.0.4 Fixed in 2025.1.6, 2026.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*before 2025.1.6; 2026.0.0 to before 2026.0.4VulnerableProgress
  • cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* Versions before 2025.1.6; 2026.0.0 to before 2026.0.4 Vulnerable ·Progress

Remediation

Upgrade MOVEit Transfer to version 2025.1.6 or to version 2026.0.4, depending on which release is in use.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA MOVEit Transfer (Progress) Fixed in 2025.1.6, 2026.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress MOVEit Transfer — community.progress.com/s/article/MOVEit-Transfer-Critical-S…

    12 records Highest priority Priority MEDIUM 8 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-74039 Authentication bypass in Progress MOVEit Transfer LDAP sign-onPriority MEDIUM 44
    • TI-2026-74047 SQL injection in MOVEit Transfer custom reportingPriority MEDIUM 41
    • TI-2026-74045 Improper Unicode handling in MOVEit Transfer bypasses email MFAPriority MEDIUM 41
    Show all 12 records → Advisory →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-89073
  2. 2026-10-15 Alias added: GHSA-vwr9-5p5q-ghvv
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW
  5. 2026-10-19 CVSS score added · NVD
  6. 2026-10-19 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2023-17193 In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17805 In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6… CVSS 3.1CRITICAL 9.8
  • TI-2023-18713 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1CRITICAL 9.1
  • TI-2024-05383 MOVEit Transfer Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-18711 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1HIGH 8.1
  • TI-2023-18712 In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7… CVSS 3.1HIGH 7.5
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences