Improper Handling of Unicode Encoding in MOVEit Transfer - CVE-2026-89074
Published: October 16, 2026
Vulnerability identifier: #VU155964
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89074
CWE-ID: CWE-176
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially bypass input-related security checks through inconsistent interpretation of Unicode input.
The vulnerability exists due to improper handling of Unicode encoding in MOVEit Transfer when processing Unicode input. A remote attacker can supply specially crafted Unicode input to exploit differences in its interpretation, potentially bypassing security checks that depend on consistent input handling.
Affected software
MOVEit Transfer
How to mitigate CVE-2026-89074
Install security update from vendor's website.
MOVEit Transfer - addressed in versions 2025.1.6, 2026.0.4