Progress MOVEit Transfer: Incorrect authorization in Client Certificates module
Summary
A flaw in the Client Certificates module of Progress MOVEit Transfer allows an authenticated user to bypass authorization checks (CWE-863). An attacker with a valid low-privilege account could potentially access functions or data beyond their intended permissions. The sources disagree on the CVSS score: the provided data states 8.8, while the CNA data and the Progress bulletin list 7.5. Exploitation in the wild is not known.
Affected
- MOVEit Transfer before 2025.1.6
- MOVEit Transfer 2026.0.0 before 2026.0.4
- Progress bulletin also lists 2025.0.8 and earlier as affected (these must upgrade to an actively supported version)
Fixed in
- MOVEit Transfer 2025.1.6
- MOVEit Transfer 2026.0.4
No separate patch for this CVE; the fix is the release upgrade.
Workaround
Unknown.
No vendor-documented interim mitigation for this module was found in the sources.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept reported as of the research date.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade MOVEit Transfer to 2025.1.6 or 2026.0.4 (or a supported later version) as one maintenance action covering the whole September 2026 bulletin.
- Until patched, restrict who can reach the MOVEit web interface and review client certificate and access permission settings.
- Verify the CVSS score in NVD before reporting severity.
- Monitor CISA KEV and the Progress bulletin for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MOVEit Transfer Critical Security Bulletin - September 2026 community.progress.com
- OpenCVE: CVE-2026-89072 app.opencve.io
- OffSeq Radar: CVE-2026-89072 radar.offseq.com
- Strix: CVE-2026-89072 www.strix.ai
- Cyberpress: Multiple MOVEit Transfer flaws cyberpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:45.
Original description (NVD)
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.