Is CVE-2026-89071 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89071 being exploited in the wild.

How severe is CVE-2026-89071?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89071?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89071 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89071?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89071: Progress MOVEit Transfer LDAP injection in LDAP module

CVE-2026-89071 · Severity: high · CVSS 7.5 · Published 2026-10-14

MOVEit Transfer is a secure file transfer solution used by enterprises to exchange sensitive data. An LDAP injection vulnerability in its LDAP authentication module allows an attacker to manipulate authentication queries, potentially bypassing access controls or extracting sensitive directory information. This could lead to unauthorized access to transferred files or system compromise.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89071 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89071 being exploited in the wild.
How severe is CVE-2026-89071?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89071?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89071 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89071?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

The vulnerability is an LDAP injection in the LDAP module of MOVEit Transfer, where special characters in LDAP queries are not properly neutralized. An attacker with network access to the LDAP authentication interface can inject malicious LDAP filter syntax to alter query logic. This affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Affected products

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.