Incorrect authorization in MOVEit Transfer - CVE-2026-89072
Published: October 16, 2026
Vulnerability identifier: #VU155968
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89072
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially access resources or perform operations beyond their intended authorization.
The vulnerability exists due to incorrect authorization in MOVEit Transfer when evaluating access to protected resources or operations. A remote attacker can submit requests that exploit incorrect authorization decisions to potentially access resources or perform operations outside their permitted scope.
Affected software
MOVEit Transfer
How to mitigate CVE-2026-89072
Install security update from vendor's website.
MOVEit Transfer - addressed in versions 2025.1.6, 2026.0.4