Known vulnerabilities in MOVEit Transfer 2026.0.3

Version: 2026.0.3
Software CPE: cpe:2.3:a:progress_software_corporation:moveit_transfer:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting MOVEit Transfer version 2026.0.3 MOVEit Transfer 2026.0.3 is affected by 12 vulnerabilities: 1 high, 9 medium, 2 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU155961 - Incorrect Permission Assignment for Critical Resource
CVE-2026-87093
CWE-732 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155962 - Missing Critical Step in Authentication
CVE-2026-89068
CWE-304 High
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155963 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-89069
CWE-79 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155964 - Improper Handling of Unicode Encoding
CVE-2026-89074
CWE-176 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155965 - Authentication Bypass by Capture-replay
CVE-2026-89070
CWE-294 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155966 - Incorrect Implementation of Authentication Algorithm
CVE-2026-89077
CWE-303 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155967 - Insufficient Session Expiration
CVE-2026-89073
CWE-613 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155968 - Incorrect Authorization
CVE-2026-89072
CWE-863 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155969 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2026-89071
CWE-90 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155970 - Insecure Storage of Sensitive Information
CVE-2026-89075
CWE-922 Low
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155971 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-89076
CWE-89 Low
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155960 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-89067
CWE-288 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601