CVE-2026-89069
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Ad Hoc module of Progress MOVEit Transfer contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Risk Assessment
An attacker could execute a malicious script in the victim's browser, potentially leading to session theft, credential theft, or unauthorized actions.
Recommendation
Update MOVEit Transfer to version 2025.1.6 or 2026.0.4 (or later). Deploy Content-Security-Policy headers as an additional safeguard.
Other vulnerabilities in Progress MOVEit Transfer
See all- CVE-2026-89077High
The SFTP module of Progress MOVEit Transfer contains an incorrect implementation of the authentication algorithm. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89076High
The Custom Reports module of Progress MOVEit Transfer is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89075High
Progress MOVEit Transfer contains an insecure storage of sensitive information vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89074High
Progress MOVEit Transfer contains an improper handling of Unicode encoding vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89073High
Progress MOVEit Transfer contains an insufficient session expiration vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89072High
The Client Certificates module of Progress MOVEit Transfer contains an incorrect authorization vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89071High
The LDAP module of Progress MOVEit Transfer is vulnerable to LDAP injection due to improper neutralization of special elements in LDAP queries. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89070High
The OIDC module of Progress MOVEit Transfer contains an authentication bypass by capture-replay vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89068High
The LDAP module of Progress MOVEit Transfer contains a missing critical step in authentication vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-89067High
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS