SB2026101601 - Multiple vulnerabilities in MOVEit Transfer

Description

This security bulletin contains information about 12 vulnerabilities.

1) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-89067)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication and potentially gain unauthorized access.

The vulnerability exists due to authentication bypass using an alternate path or channel in MOVEit Transfer when handling authentication requests. A remote user can access an alternate path that does not enforce the expected authentication checks to potentially gain unauthorized access.

2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-87093)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to potentially access a critical resource without sufficient authorization.

The vulnerability exists due to incorrect permission assignment for a critical resource in MOVEit Transfer when controlling access to that resource. A remote user can exercise permissions granted more broadly than intended to potentially gain unauthorized access to the resource.

3) Missing Critical Step in Authentication (CVE-ID: CVE-2026-89068)

CWE-ID: CWE-304 - Missing Critical Step in Authentication

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass an authentication requirement and potentially gain unauthorized access.

The vulnerability exists due to a missing critical step in authentication in MOVEit Transfer when processing authentication attempts. A remote attacker can attempt authentication without completing the omitted verification step to potentially gain unauthorized access.

4) Cross-site scripting (CVE-ID: CVE-2026-89069)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser in the context of the affected web application.

The vulnerability exists due to improper neutralization of input during web page generation in MOVEit Transfer when rendering untrusted content. A remote attacker can supply crafted input that is interpreted as active content when a victim views the affected page to execute arbitrary script in the application's browser context.

5) Improper Handling of Unicode Encoding (CVE-ID: CVE-2026-89074)

CWE-ID: CWE-176 - Improper Handling of Unicode Encoding

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially bypass input-related security checks through inconsistent interpretation of Unicode input.

The vulnerability exists due to improper handling of Unicode encoding in MOVEit Transfer when processing Unicode input. A remote attacker can supply specially crafted Unicode input to exploit differences in its interpretation, potentially bypassing security checks that depend on consistent input handling.

6) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-89070)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication by replaying captured authentication data and potentially impersonate another user.

The vulnerability exists due to authentication bypass by capture-replay in MOVEit Transfer when validating authentication data. A remote attacker can replay previously captured valid authentication data to potentially authenticate as the associated user.

7) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-89077)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially bypass authentication and gain unauthorized access.

The vulnerability exists due to incorrect implementation of an authentication algorithm in MOVEit Transfer when verifying authentication attempts. A remote attacker can submit authentication data that exploits the algorithm's incorrect verification behavior to potentially gain unauthorized access.

8) Insufficient Session Expiration (CVE-ID: CVE-2026-89073)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially reuse a session that should have expired and gain unauthorized access.

The vulnerability exists due to insufficient session expiration in MOVEit Transfer when validating existing sessions. A remote attacker can reuse a previously obtained session credential beyond its intended validity period to potentially access the associated user's session.

9) Incorrect authorization (CVE-ID: CVE-2026-89072)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially access resources or perform operations beyond their intended authorization.

The vulnerability exists due to incorrect authorization in MOVEit Transfer when evaluating access to protected resources or operations. A remote attacker can submit requests that exploit incorrect authorization decisions to potentially access resources or perform operations outside their permitted scope.

10) LDAP injection (CVE-ID: CVE-2026-89071)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to manipulate LDAP queries and potentially gain unauthorized access to directory information.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in MOVEit Transfer when incorporating untrusted input into LDAP queries. A remote attacker can supply input containing LDAP query syntax to alter query logic and potentially access directory information outside the intended query scope.

11) Insecure Storage of Sensitive Information (CVE-ID: CVE-2026-89075)

CWE-ID: CWE-922 - Insecure Storage of Sensitive Information

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially obtain sensitive information from inadequately protected storage.

The vulnerability exists due to insecure storage of sensitive information in MOVEit Transfer when retaining sensitive data. A remote attacker can access inadequately protected stored data, if able to reach the affected storage, to potentially obtain sensitive information.

12) SQL injection (CVE-ID: CVE-2026-89076)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to manipulate SQL commands and potentially access or modify database information without authorization.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in MOVEit Transfer when incorporating untrusted input into SQL commands. A remote privileged user can supply crafted input containing SQL syntax to alter command logic and potentially read or modify data within the application's database permissions.

Remediation

Install update from vendor's website.

References

• https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026?popup=true&overview