Known vulnerabilities in MOVEit Transfer - page 2

Software CPE: cpe:2.3:a:progress_software_corporation:moveit_transfer:*:*:*:*:*:*:*:*
Total vulnerabilities: 29
Public exploits: 3
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting MOVEit Transfer MOVEit Transfer is affected by 29 known vulnerabilities: 2 critical, 6 high, 15 medium, 6 low Critical High Medium Low

Vulnerabilities (29)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU155963 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-89069
CWE-79 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155964 - Improper Handling of Unicode Encoding
CVE-2026-89074
CWE-176 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155965 - Authentication Bypass by Capture-replay
CVE-2026-89070
CWE-294 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155966 - Incorrect Implementation of Authentication Algorithm
CVE-2026-89077
CWE-303 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155967 - Insufficient Session Expiration
CVE-2026-89073
CWE-613 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155968 - Incorrect Authorization
CVE-2026-89072
CWE-863 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155969 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2026-89071
CWE-90 Medium
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155970 - Insecure Storage of Sensitive Information
CVE-2026-89075
CWE-922 Low
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601
#VU155971 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-89076
CWE-89 Low
No
No
2025.1.6, 2026.0.4 16.10.2026 SB2026101601


Showing elements 21 - 40 out of 29