CVE-2026-89069 Progress CVE debrief

Who should care

Defenders responsible for MOVEit Transfer instances, especially those exposed to the internet or used by multiple users, should be aware of this vulnerability and take steps to patch or mitigate it.

Why it matters

A stored XSS vulnerability in Progress MOVEit Transfer's Ad Hoc module requires patching and monitoring to prevent potential security breaches.

• An attacker could inject malicious scripts into web pages, potentially leading to security breaches.
• Defenders need to verify if their MOVEit Transfer instances are vulnerable and patch them accordingly.
• The vulnerability requires verification of affected versions and instances.
• Defenders should monitor MOVEit Transfer instances for suspicious activity.

Technical summary

The vulnerability exists in the Ad Hoc module of Progress MOVEit Transfer, allowing an attacker to inject malicious scripts into web pages. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4. An attacker could inject malicious scripts into web pages, potentially leading to security breaches. Defenders need to verify if their MOVEit Transfer instances are vulnerable and patch them accordingly. The vulnerability requires verification of affected versions and instances.

Defensive priority

Defenders should prioritize patching vulnerable MOVEit Transfer instances, especially those exposed to the internet or used by multiple users.

Recommended defensive actions

• Patch vulnerable MOVEit Transfer instances to version 2025.1.6 or later, or 2026.0.4 or later.
• Restrict access to the Ad Hoc module to authorized users only.
• Monitor MOVEit Transfer instances for suspicious activity.

Evidence notes

The CVE record and source item provide details about the vulnerability, but additional information from vendor advisories and other sources may be necessary to fully understand the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.