Is CVE-2026-89067 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89067 being exploited in the wild.

How severe is CVE-2026-89067?

High severity, with a CVSS score of 8.8, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89067?

Yes: fixed in 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89067 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89067?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89067: Progress MOVEit Transfer authentication bypass

CVE-2026-89067 · Severity: high · CVSS 8.8 · Published 2026-10-14

Progress MOVEit Transfer is a managed file transfer service used by enterprises to securely exchange data. An authentication bypass vulnerability allows attackers to bypass access controls using an alternate path, potentially gaining unauthorized access to sensitive files and enabling data theft or unauthorized file operations.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89067 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89067 being exploited in the wild.
How severe is CVE-2026-89067?: High severity, with a CVSS score of 8.8, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89067?: Yes: fixed in 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89067 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89067?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2025.1.6, 2026.0.4

Technical details

An alternate path or channel vulnerability in MOVEit Transfer permits authentication bypass, allowing unauthenticated or lower-privileged attackers to circumvent access controls. The vulnerability affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4, accessible over the network with no user interaction required.

Affected products

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.