Is CVE-2026-89072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89072 being exploited in the wild.

How severe is CVE-2026-89072?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89072?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89072 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89072?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89072: Progress MOVEit Transfer incorrect authorization in Client Certificates

CVE-2026-89072 · Severity: high · CVSS 7.5 · Published 2026-10-14

Progress MOVEit Transfer is a secure file transfer solution used by enterprises to move sensitive data. An incorrect authorization vulnerability in the Client Certificates module allows attackers to bypass access controls and potentially access files or perform operations they should not be permitted to perform. The vulnerability affects versions before 2025.1.6 and 2026.0.0 through 2026.0.3.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89072 being exploited in the wild.
How severe is CVE-2026-89072?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89072?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89072 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89072?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

The vulnerability is an incorrect authorization flaw in the Client Certificates module of MOVEit Transfer, allowing attackers to circumvent access controls. The issue affects versions prior to 2025.1.6 and 2026.0.0 before 2026.0.4. A network attacker can exploit this to gain unauthorized access to protected resources, though no active exploitation in the wild has been reported.

Affected products

Progress MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.