LDAP injection in MOVEit Transfer - CVE-2026-89071
Published: October 16, 2026
Vulnerability identifier: #VU155969
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89071
CWE-ID: CWE-90
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate LDAP queries and potentially gain unauthorized access to directory information.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in MOVEit Transfer when incorporating untrusted input into LDAP queries. A remote attacker can supply input containing LDAP query syntax to alter query logic and potentially access directory information outside the intended query scope.
Affected software
MOVEit Transfer
How to mitigate CVE-2026-89071
Install security update from vendor's website.
MOVEit Transfer - addressed in versions 2025.1.6, 2026.0.4