The short answer
On October 14, 2026, Progress Software published an advisory covering twelve high-severity vulnerabilities in MOVEit Transfer, its enterprise managed file transfer platform. The flaws carry CVSS scores ranging from 7.2 to 8.8 and span authentication bypass, injection, session handling, and insecure data storage. Every release before 2025.1.6 is affected, as is the 2026.0.0 line up to (but not including) 2026.0.4. The fixes are 2025.1.6 and 2026.0.4, and administrators should upgrade immediately. As of October 19, 2026, there is no public proof-of-concept code and no confirmed active exploitation, which makes this the ideal moment to patch. The window between disclosure and weaponization is exactly when advisories like this one matter most.
Why a MOVEit advisory is never routine
MOVEit Transfer sits at the center of how thousands of organizations move sensitive files. Payroll exports, healthcare records, financial statements, and legal documents flow through managed file transfer servers every day, which is precisely why these systems are such attractive targets. An attacker who compromises a file transfer server does not get one company’s data. They potentially get the data of every organization and partner that exchanges files through it.
The reason every MOVEit advisory commands immediate attention goes back to 2023, when the Cl0p ransomware group exploited a SQL injection flaw (CVE-2023-34362) in MOVEit Transfer and ultimately affected hundreds of organizations. Many victims learned they had been breached only when their stolen data appeared on a leak site, and the fallout dragged on for months as downstream customers of the breached organizations discovered their own exposure. That campaign permanently changed how the security industry treats vulnerabilities in managed file transfer software. A MOVEit advisory is now read the way a fire alarm is heard: even if this one turns out to be minor, nobody waits to find out.
It has been a crowded stretch for security teams generally. Pwn2Own Ireland’s day-one results added fresh bugs to everyone’s tracking queues, and Fortimail administrators were patching a zero-day of their own in the same window (see our breakdown of the Fortimail zero-day). Against that backdrop, a twelve-flaw advisory for one of the most targeted file transfer products on the market deserves to go to the top of the patch queue, not the bottom.
The twelve flaws, grouped by type
Progress rated all twelve vulnerabilities as High severity. Two of them share the top CVSS score of 8.8, and the rest cluster between 7.2 and 8.1. Rather than walking through them in CVE number order, it is more useful to group them by what an attacker would actually do with them.
The two most severe flaws
CVE-2026-87093 (CVSS 8.8, CWE-732) is an incorrect permission assignment on directories belonging to critical services. In plain terms, folders that should be locked down are not, and a local attacker can abuse that misconfiguration to escalate their privileges on the server. Local privilege escalation on a file transfer server is a serious matter, because the jump from a low-privileged foothold to full control of the system is often the step that turns a minor intrusion into a data breach.
CVE-2026-89067 (CVSS 8.8, CWE-288) is arguably the more worrying of the two for most deployments. It is an authentication bypass through an alternate path in the Secure Messaging component, and it is reachable by a low-privileged remote attacker. Authentication bypasses are the flaw class that keeps incident responders awake, because they let an attacker skip the front door entirely. Any MOVEit Transfer instance reachable from the internet should treat this CVE as the headline item in the advisory.
Authentication and authorization weaknesses
Five of the twelve flaws sit in the authentication and authorization layer, which suggests the audit behind this advisory spent serious time on identity handling. CVE-2026-89068 (CVSS 8.1) is a missing authentication step in the LDAP module that can lead to unauthenticated compromise, meaning an attacker may not need any credentials at all. CVE-2026-89070 (CVSS 7.5) is a capture-replay weakness in the OpenID Connect flow that enables authentication bypass. CVE-2026-89072 (CVSS 7.5) is an incorrect authorization flaw in the Client Certificates feature, and CVE-2026-89077 (CVSS 7.5) is an incorrect implementation of authentication in the SFTP module.
Authentication logic is having a rough season across enterprise software. Citrix NetScaler administrators recently dealt with their own pair of zero-days in the same broad category (see our explainer on the Citrix NetScaler zero-days). When identity checks fail in infrastructure software, the blast radius is rarely limited to a single feature, so organizations should review how their MOVEit deployment authenticates users across every enabled module, not just the ones named in the CVE descriptions.
Injection flaws
Three of the vulnerabilities are injection flaws, the same general family as the bug behind the 2023 Cl0p campaign, which is reason enough to read this section carefully. CVE-2026-89071 (CVSS 7.5) is an LDAP injection vulnerability. CVE-2026-89076 (CVSS 7.2) is a SQL injection flaw in the Custom Reports module; it requires an attacker who already holds high privileges, which lowers its urgency relative to the remote bypasses above but does not make it ignorable, since privilege escalation elsewhere in this advisory could supply exactly those privileges. CVE-2026-89069 (CVSS 8.0) is a cross-site scripting vulnerability in the Ad Hoc module, the highest-scored of the injection group, and a reminder that file transfer workflows with browser-facing components inherit web application risks too.
Session handling and data storage
The remaining flaws are less dramatic individually but meaningful in combination. CVE-2026-89073 (CVSS 7.5) is an insufficient session expiration weakness: sessions that should have died keep living, giving an attacker who steals a session token a longer window to use it. CVE-2026-89075 covers insecure storage of sensitive data, and CVE-2026-89074 covers improper handling of Unicode encoding. Encoding flaws sound obscure until you remember that input validation bypasses are frequently built on exactly this kind of subtle mishandling. None of these three is likely to be anyone’s top patching priority on its own, but upgrading fixes all of them at once, so there is no reason to triage them individually.
Which versions are affected
According to the Progress advisory, every MOVEit Transfer release before 2025.1.6 is vulnerable. The newer 2026.0.0 line is also affected, from 2026.0.0 up to (but not including) 2026.0.4. The fixed releases are 2025.1.6 and 2026.0.4. Because both branches received fixes, there is no need to jump major versions to be protected: if you are on the 2025.1.x line, moving to 2025.1.6 is enough, and if you are on 2026.0.x, move to 2026.0.4.
If you are unsure which version you are running, check it in the MOVEit Transfer admin console before planning the upgrade. Also inventory your environment for instances you may have forgotten: test servers, disaster recovery standbys, and legacy deployments that were supposed to be decommissioned are the classic places where unpatched software hides.
What to do now: a patching checklist for administrators
No exploitation has been confirmed, so this is a preventive exercise rather than incident response. Work through these steps in order.
- Inventory every MOVEit Transfer instance. Production, staging, test, and disaster recovery environments all count. If an instance exists, it needs the patch.
- Confirm your version against the affected ranges. Anything before 2025.1.6, or 2026.0.0 through before 2026.0.4, is vulnerable.
- Back up before you upgrade. Take configuration and data backups, and snapshot the VM if MOVEit runs virtualized. Upgrades rarely fail, but the one time you skip the backup is the time you will need it.
- Upgrade to the fixed release on your branch. That is 2025.1.6 for the 2025.1.x line and 2026.0.4 for the 2026.0.x line. Schedule the maintenance window promptly; with twelve High-severity flaws disclosed, delay buys nothing.
- Review logs for signs of probing. Look for unusual authentication failures, unexpected LDAP queries, odd SFTP session patterns, and access to the Secure Messaging or Ad Hoc modules outside normal hours. The recent Zammad zero-day episode is a useful reminder of how quickly a disclosed flaw can attract attention, so check even though no exploitation has been confirmed.
- Reduce exposure while you patch. If the upgrade cannot happen today, restrict access to the MOVEit admin interfaces and limit which networks can reach the server. This is mitigation, not a substitute for patching.
- Rotate secrets if you have any doubt. If log review turns up anything suspicious, rotate service credentials, API keys, and certificates associated with the deployment.
- Subscribe to Progress security notifications. The advisory was published through the Progress Community portal. Make sure someone on your team actually receives these notices instead of discovering the next advisory from the news.
Frequently asked questions
Is there any evidence these MOVEit flaws are being exploited?
No. As of October 19, 2026, there is no public proof-of-concept code and no confirmed active exploitation of any of the twelve vulnerabilities. That is genuinely good news, but it is not a reason to delay. The 2023 Cl0p campaign demonstrated how quickly attackers can move from disclosure to mass exploitation with MOVEit flaws specifically, so the safe assumption is that the clock is ticking.
Which MOVEit Transfer versions do I need to patch?
Patch anything running a release before 2025.1.6, and anything on the 2026.0.0 line before 2026.0.4. The fixed versions are 2025.1.6 and 2026.0.4. Stay on your current branch; you do not need to migrate between major versions to get the fixes.
What is the single most dangerous vulnerability in this batch?
Two CVEs tie for the highest score at CVSS 8.8: CVE-2026-87093, a local privilege escalation through misconfigured service directory permissions, and CVE-2026-89067, a remote authentication bypass in Secure Messaging reachable by a low-privileged attacker. For internet-facing servers, the authentication bypass (CVE-2026-89067) is the one to worry about most. For servers with many local users, the privilege escalation (CVE-2026-87093) deserves equal attention.
My MOVEit server is not exposed to the internet. Do I still need to patch?
Yes. Several of these flaws, including the LDAP authentication issue and the local privilege escalation, are relevant to attackers who already have some level of internal access, whether that is a compromised workstation, a malicious insider, or another breached system on the same network. Internal servers also have a habit of becoming externally reachable after network changes. Patch regardless of exposure.
How is this different from the 2023 MOVEit attacks?
The 2023 incident was a single SQL injection flaw (CVE-2023-34362) that was already being actively exploited at scale by the Cl0p ransomware group when most organizations learned about it, and it ultimately affected hundreds of organizations. This advisory is the opposite situation: twelve flaws disclosed proactively by the vendor, with fixes available on day one and no known exploitation. The 2023 episode was incident response. This one is preventive maintenance, and it is much cheaper.
Where do I download the fixed versions?
Through the Progress Community portal, where the advisory was published, or via Progress support downloads. If your organization does not have portal access, contact Progress support directly rather than hunting for the installers on third-party sites.
The bottom line is straightforward. Twelve high-severity flaws, fixes already available, no exploitation yet, and a product with a history of attracting exactly the kind of attacker who watches for advisories like this. Patch MOVEit Transfer to 2025.1.6 or 2026.0.4 now, and this advisory becomes a footnote instead of an incident.