Progress MOVEit Transfer: LDAP injection in certificate-based authentication

Summary

The LDAP module of Progress MOVEit Transfer does not neutralise special characters in LDAP queries, which enables LDAP injection. Per the CVE data (CVSS 8.8, vector AV:N/AC:L/PR:L), an attacker on the network with a low-privilege account could affect confidentiality, integrity and availability. The CVE title links the flaw to certificate-based authentication, which the vendor has not confirmed in the sources reviewed.

Affected

• MOVEit Transfer before 2025.1.6
• MOVEit Transfer 2026.0.0 before 2026.0.4
• According to the vendor bulletin, 2025.0.8 and earlier are also affected; these versions are out of support (confirm against the full advisory).

Fixed in

• Upgrade to MOVEit Transfer 2025.1.6 or 2026.0.4 (or later).

Workaround

• No vendor workaround known.
• Interim measure (our recommendation, not from the vendor): restrict access to the MOVEit web and LDAP-facing components and review the permissions of LDAP service accounts. Ask Progress whether certificate-based login can be disabled temporarily.

Exploitation

• Not listed in the CISA KEV catalogue.
• CISA SSVC data in the CVE record: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept or in-the-wild exploitation found. This is not confirmed absence.

Our recommendation

• Check whether MOVEit Transfer is internet-facing and which version is running.
• If internet-facing and older than 2025.1.6 or 2026.0.4, patch as a priority.
• Patch all nine CVEs of Progress's September 2026 bulletin in one maintenance window.
• Restrict LDAP service-account permissions and monitor authentication logs.
• Watch the vendor advisory and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Progress MOVEit Transfer Critical Security Bulletin, September 2026 community.progress.com
• OpenCVE: CVE-2026-89071 app.opencve.io
• CISA Cybersecurity Advisory AA23-158A (MOVEit Transfer) www.cisa.gov
• Positive Technologies PT-2026-114323 vulners.com
• CyberPress: Multiple MOVEit Transfer flaws cyberpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:45.