Read the docs
TI-2026-74045 Aliases CVE-2026-89074GHSA-vhqc-26qr-xc8f

Improper Unicode handling in MOVEit Transfer bypasses email MFA

Priority MEDIUM 41CWE-176Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4 contains an improper handling of Unicode encoding flaw (CWE-176). A remote attacker with low privileges can exploit it to bypass email multi-factor authentication, with high impact on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00482 41st percentileScored 2026-11-07
Fix Fixed MOVEit Transfer (Progress): 2025.1.6, 2026.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressMOVEit Transferbefore 2025.1.6; 2026.0.0 to before 2026.0.42025.1.6, 2026.0.4Patch availableCNA
  • MOVEit Transfer VendorProgress Affected before 2025.1.6; 2026.0.0 to before 2026.0.4 Fixed in 2025.1.6, 2026.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*before 2025.1.6; 2026.0.0 to before 2026.0.4VulnerableProgress
  • cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* Versions before 2025.1.6; 2026.0.0 to before 2026.0.4 Vulnerable ·Progress

Remediation

Upgrade MOVEit Transfer to 2025.1.6 or 2026.0.4. The sources list no further fixed versions for MOVEit Transfer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA MOVEit Transfer (Progress) Fixed in 2025.1.6, 2026.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress MOVEit Transfer — community.progress.com/s/article/MOVEit-Transfer-Critical-S…

    12 records Highest priority Priority MEDIUM 8 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-74039 Authentication bypass in Progress MOVEit Transfer LDAP sign-onPriority MEDIUM 44
    • TI-2026-74044 Access restriction bypass in Progress MOVEit Transfer OAuth authenticationPriority MEDIUM 43
    • TI-2026-74047 SQL injection in MOVEit Transfer custom reportingPriority MEDIUM 41
    Show all 12 records → Advisory →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-89074
  2. 2026-10-15 Alias added: GHSA-vhqc-26qr-xc8f
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW
  5. 2026-10-19 CVSS score added · NVD
  6. 2026-10-19 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2023-17193 In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17805 In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6… CVSS 3.1CRITICAL 9.8
  • TI-2023-18713 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1CRITICAL 9.1
  • TI-2024-05383 MOVEit Transfer Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-18711 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1HIGH 8.1
  • TI-2023-18712 In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7… CVSS 3.1HIGH 7.5
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences