Is CVE-2026-89070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89070 being exploited in the wild.

How severe is CVE-2026-89070?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89070?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89070 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89070?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89070: Progress MOVEit Transfer authentication bypass in OIDC module

CVE-2026-89070 · Severity: high · CVSS 7.5 · Published 2026-10-14

MOVEit Transfer is a managed file transfer solution used by enterprises to securely exchange files. An authentication bypass vulnerability in its OIDC (OpenID Connect) module allows attackers to bypass login controls through a capture-replay attack, potentially gaining unauthorized access to the system and sensitive files.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89070 being exploited in the wild.
How severe is CVE-2026-89070?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89070?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89070 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89070?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

The OIDC module in MOVEit Transfer is vulnerable to a capture-replay attack that allows authentication bypass. An attacker can intercept and replay authentication tokens to gain unauthorized access without valid credentials. The vulnerability affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Affected products

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.