SQL injection in MOVEit Transfer - CVE-2026-89076
Published: October 16, 2026
Vulnerability identifier: #VU155971
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89076
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to manipulate SQL commands and potentially access or modify database information without authorization.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in MOVEit Transfer when incorporating untrusted input into SQL commands. A remote privileged user can supply crafted input containing SQL syntax to alter command logic and potentially read or modify data within the application's database permissions.
Affected software
MOVEit Transfer
How to mitigate CVE-2026-89076
Install security update from vendor's website.
MOVEit Transfer - addressed in versions 2025.1.6, 2026.0.4