PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89067 Progress CVE debrief

CVE-2026-89067 is an authentication bypass vulnerability in Progress MOVEit Transfer, affecting versions before 2025.1.6 and from 2026.0.0 before 2026.0.4. This issue allows attackers to bypass authentication using an alternate path or channel. Defenders should assess exposure, prioritize remediation, and verify affected systems. The vulnerability has a high CVSS score of 8.8, indicating a high severity. Affected versions of MOVEit Transfer should be updated to the latest version to prevent exploitation.

Vendor
Progress
Product
MOVEit Transfer
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders and administrators of MOVEit Transfer instances should assess exposure and prioritize remediation. This includes reviewing system configurations, verifying authentication settings, and ensuring that affected versions are updated to the latest version. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on their systems.

Why it matters

CVE-2026-89067 is a high-severity authentication bypass vulnerability in Progress MOVEit Transfer. Defenders should assess exposure, prioritize remediation, and verify affected systems.

  • Verify authentication settings and configurations
  • Assess exposure of MOVEit Transfer instances
  • Prioritize remediation of affected versions

Technical summary

CVE-2026-89067 is an authentication bypass vulnerability in Progress MOVEit Transfer, affecting versions before 2025.1.6 and from 2026.0.0 before 2026.0.4. The vulnerability allows attackers to bypass authentication using an alternate path or channel.

Defensive priority

High priority due to authentication bypass vulnerability

Recommended defensive actions

  • Assess exposure of MOVEit Transfer instances
  • Prioritize remediation of affected versions
  • Verify system configurations and authentication settings

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and vendor advisory. The vulnerability is a high-severity authentication bypass issue in Progress MOVEit Transfer, affecting versions before 2025.1.6 and from 2026.0.0 before 2026.0.4. The CVE record was published on 2026-10-14T15:05:26.675Z and has not been modified since then. The source item provides additional details on the vulnerability and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89067 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89067

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89067 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89067

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • MOVEit Transfer Secure Messaging Authentication Bypass

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89067.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

    Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.