Read the docs
TI-2026-74046 Aliases CVE-2026-89075GHSA-58x2-jh6g-gpg3

Insecure storage of session information in Progress MOVEit Transfer

Priority LOW 33CWE-922Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-922.

Summary

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4 stores sensitive information insecurely (CWE-922). A local user with low privileges can read session information, and user interaction is required. The flaw has no known exploitation and is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed MOVEit Transfer (Progress): 2025.1.6, 2026.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressMOVEit Transferbefore 2025.1.6; 2026.0.0 to before 2026.0.42025.1.6, 2026.0.4Patch availableCNA
  • MOVEit Transfer VendorProgress Affected before 2025.1.6; 2026.0.0 to before 2026.0.4 Fixed in 2025.1.6, 2026.0.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*before 2025.1.6; 2026.0.0 to before 2026.0.4VulnerableProgress
  • cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* Versions before 2025.1.6; 2026.0.0 to before 2026.0.4 Vulnerable ·Progress

Remediation

Upgrade MOVEit Transfer to 2025.1.6 or 2026.0.4. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA MOVEit Transfer (Progress) Fixed in 2025.1.6, 2026.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress MOVEit Transfer — community.progress.com/s/article/MOVEit-Transfer-Critical-S…

    12 records Highest priority Priority MEDIUM 8 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-74039 Authentication bypass in Progress MOVEit Transfer LDAP sign-onPriority MEDIUM 44
    • TI-2026-74044 Access restriction bypass in Progress MOVEit Transfer OAuth authenticationPriority MEDIUM 43
    • TI-2026-74047 SQL injection in MOVEit Transfer custom reportingPriority MEDIUM 41
    Show all 12 records → Advisory →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-89075
  2. 2026-10-15 Alias added: GHSA-58x2-jh6g-gpg3
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-17193 In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17805 In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6… CVSS 3.1CRITICAL 9.8
  • TI-2023-18713 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1CRITICAL 9.1
  • TI-2024-05383 MOVEit Transfer Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-18711 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7… CVSS 3.1HIGH 8.1
  • TI-2023-18712 In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7… CVSS 3.1HIGH 7.5
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences