Progress MOVEit Transfer: Authentication bypass in LDAP sign-on
Summary
A missing critical authentication step in the LDAP module of Progress MOVEit Transfer can allow an attacker to bypass authentication for LDAP sign-on. The CVE record lists affected versions as before 2025.1.6 and 2026.0.0 up to before 2026.0.4, and the attack vector is network-based. The CVSS score is disputed (9.8 in the CVE data, 8.1 in secondary sources), and no in-the-wild exploitation is documented in the sources reviewed. Internet-facing MOVEit servers with LDAP sign-on enabled carry the highest risk.
Affected
- MOVEit Transfer before 2025.1.6 (2025.1.x branch)
- MOVEit Transfer from 2026.0.0 before 2026.0.4 (2026.0.x branch)
- Versions 2025.0.8 and earlier are not patched within a branch.
Fixed in
- 2025.1.6 (2025.1.x branch)
- 2026.0.4 (2026.0.x branch)
- Build numbers are not confirmed beyond the vendor bulletin.
Workaround
No vendor workaround documented. Unverified third-party advice: restrict network access to MOVEit Transfer to trusted sources until patched. Unknown whether disabling LDAP sign-on removes the exposure.
Exploitation
- Exploited in the wild: Unknown. No evidence in the sources reviewed.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Public proof-of-concept: none found.
- One VulDB page carries a '0-Day' label; its meaning is unresolved.
Our recommendation
- Confirm the exact MOVEit Transfer version in the MOVEit Config utility and check whether LDAP sign-on is in use.
- Upgrade to 2025.1.6 or 2026.0.4 as soon as possible; move versions 2025.0.8 or earlier to a supported release.
- Until patched, limit web and SFTP access to known sources and review authentication logs for LDAP sign-on anomalies.
- Verify the NVD score and CISA KEV status before final risk rating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MOVEit Transfer Critical Security Bulletin, September 2026 community.progress.com
- OpenCVE: CVE-2026-89068 app.opencve.io
- Ionix Threat Center: CVE-2026-89068 www.ionix.io
- VulDB: CVE-2026-89068 vuldb.com
- SecurityOnline: Progress patches MOVEit Transfer vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:56.
Original description (NVD)
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.