Is CVE-2026-87093 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87093 being exploited in the wild.

How severe is CVE-2026-87093?

High severity, with a CVSS score of 8.8, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-87093?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87093 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87093?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87093: Progress MOVEit Transfer incorrect permission assignment

CVE-2026-87093 · Severity: high · CVSS 8.8 · Published 2026-10-14

MOVEit Transfer is secure file transfer software used by enterprises to exchange sensitive data. An incorrect permission assignment vulnerability allows an attacker to access critical resources they should not be authorized to use. This could lead to unauthorized access to sensitive files and data exposure.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-87093 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87093 being exploited in the wild.
How severe is CVE-2026-87093?: High severity, with a CVSS score of 8.8, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-87093?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87093 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87093?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

An incorrect permission assignment vulnerability in MOVEit Transfer fails to properly enforce access controls on critical resources. The vulnerability affects versions before 2025.1.6 and 2026.0.0 through 2026.0.4, allowing attackers with network access to bypass authorization checks and access protected resources without proper privileges.

Affected products

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.