Description
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Published: 2026-10-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows an attacker to bypass authentication by exploiting an alternate path or channel. The result is unauthorized access to MOVEit Transfer without valid credentials, and it originates from a weakness in authentication enforcement (CWE-288).

Affected Systems

Progress MOVEit Transfer versions prior to 2025.1.6 and versions 2026.0.0 through 2026.0.3 are affected. Updates starting with 2025.1.6 and 2026.0.4 contain the fix.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting current exploitation data is limited. The most likely attack vector is remote access via the alternate channel described in the bulletin. Exploitation would require the ability to send specially crafted requests to the machine hosting MOVEit Transfer.

Generated by OpenCVE AI on October 15, 2026 at 19:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MOVEit Transfer to at least 2025.1.6 if using the 2025.x series or to 2026.0.4 if using the 2026.x series
  • Apply the security patch detailed in the Progress bulletin for the affected versions
  • Restrict network access to eliminate the alternate channel that can be used for bypass; consider disabling unused services or interfaces

Generated by OpenCVE AI on October 15, 2026 at 19:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*

Sun, 18 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress moveit Transfer
Vendors & Products Progress
Progress moveit Transfer

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Title MOVEit Transfer Secure Messaging Authentication Bypass
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Progress Moveit Transfer
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T10:31:15.047Z

Reserved: 2026-09-10T18:47:56.871Z

Link: CVE-2026-89067

cve-icon Vulnrichment

Updated: 2026-10-15T10:29:23.959Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-14T16:17:54.897

Modified: 2026-10-19T12:21:40.463

Link: CVE-2026-89067

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T15:30:17Z

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel