Progress MOVEit Transfer: Authentication bypass in Secure Messaging

Summary

MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 contain an authentication bypass via an alternate path or channel (CWE-288) in the Secure Messaging component. According to the CVSS vector, a remote attacker with low privileges and no user interaction could bypass authentication and cause high impact to confidentiality, integrity and availability. Progress has not published the exact mechanism, and no exploitation in the wild or public proof of concept was reported at the time of research.

Affected

• MOVEit Transfer before 2025.1.6
• MOVEit Transfer 2026.0.0 to before 2026.0.4
• Per the research notes, this includes 2025.0.8 and earlier, 2025.1.0 to 2025.1.5, and 2026.0.0 to 2026.0.3

Fixed in

• MOVEit Transfer 2025.1.6
• MOVEit Transfer 2026.0.4
• Installations on 2025.0.8 or earlier are not on a fixed branch and must upgrade to an active, patched version.

Workaround

Unknown. No vendor-published interim workaround was found. The vendor recommends upgrading to a fixed version.

Exploitation

• Not listed in CISA KEV at the time of research.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No in-the-wild exploitation reported by Progress at the time of research.
• No public proof of concept known. The specific bypass mechanism is not public.
• Discovery credited by Progress to Leo Oliver (ssrfer).

Our recommendation

• Identify all MOVEit Transfer instances and their exact versions.
• Upgrade to 2025.1.6 or 2026.0.4 (or a later supported version), prioritising internet-facing systems.
• Apply the other fixes listed in the same Progress bulletin at the same time.
• Review accounts and logs for unusual authentication activity.
• Re-check the Progress advisory and CISA KEV regularly, as the situation may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Progress advisory: MOVEit Transfer Critical Security Bulletin, September 2026 community.progress.com
• Vulnrichment: CVE-2026-89067 vulners.com
• OpenCVE: CVE-2026-89067 app.opencve.io
• GBHackers: MOVEit Transfer security flaws gbhackers.com
• SecurityOnline: Progress patches MOVEit Transfer vulnerabilities securityonline.info
• Dev.to: MOVEit Transfer authentication bypass under CVE-2026-89067 dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:47.