Progress MOVEit Transfer: SQL injection in Custom Reports module

Summary

MOVEit Transfer's Custom Reports module does not properly neutralize special characters in SQL commands, which enables SQL injection. An attacker with an authenticated account that has report rights can read, change or delete data in the MOVEit database, which holds transfer metadata, user records and audit entries. Exploitation requires valid credentials, so exposure depends on how many accounts can use Custom Reports. The CVSS rating differs between sources, so verify it in the NVD record.

Affected

• MOVEit Transfer before 2025.1.6
• MOVEit Transfer 2026.0.0 to before 2026.0.4
• The vendor bulletin also lists 2025.0.8 and earlier as needing an upgrade to an active version.

Fixed in

• Upgrade to MOVEit Transfer 2025.1.6 or later in the 2025.1 branch
• Upgrade to MOVEit Transfer 2026.0.4 or later in the 2026.0 branch
• The vendor states that all CVEs in the September 2026 batch are resolved in these versions.

Workaround

Unknown.

• No vendor workaround is documented.
• Unofficial, third-party suggestion: limit Custom Reports to named accounts and remove it from broadly shared group roles.
• Unofficial, third-party suggestion: apply least privilege to the MOVEit database role.

Exploitation

• No evidence of exploitation in the wild found; the vendor bulletin does not state any exploitation.
• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in research.

Our recommendation

• Patch MOVEit Transfer to 2025.1.6 or 2026.0.4 as soon as possible, together with the whole September 2026 batch.
• Check the installed version now and identify all internet-facing MOVEit web consoles.
• Until patched, restrict Custom Reports to a small set of named administrators.
• Review recently created or changed custom report definitions and account activity for anything unusual.
• Verify the CVSS score in the NVD record before reporting it internally.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Progress MOVEit Transfer September 2026 Critical Security Bulletin community.progress.com
• OpenCVE: CVE-2026-89076 app.opencve.io
• Strix: CVE-2026-89076 www.strix.ai
• VulDB entry 419980 vuldb.com
• Hunting for SQL injection abuse in MOVEit Transfer before the patch lands dev.to
• CVE-2026-89076 and the reporting endpoint problem in file transfer platforms dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:46.