Is CVE-2026-89073 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89073 being exploited in the wild.

How severe is CVE-2026-89073?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6, 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89073?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89073 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89073?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89073: Progress MOVEit Transfer insufficient session expiration

CVE-2026-89073 · Severity: high · CVSS 7.5 · Published 2026-10-14

Progress MOVEit Transfer is a secure file transfer solution used by enterprises to exchange sensitive data. An insufficient session expiration vulnerability allows attackers to potentially reuse or hijack user sessions, potentially gaining unauthorized access to transferred files or account functionality without re-authentication. This could lead to unauthorized data access or modification if an attacker obtains an active session token.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89073 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89073 being exploited in the wild.
How severe is CVE-2026-89073?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6, 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89073?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89073 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89073?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

The vulnerability is an insufficient session expiration issue in MOVEit Transfer, affecting versions before 2025.1.6 and 2026.0.0 through 2026.0.3. Sessions may not properly expire, allowing an attacker with access to a valid session token to maintain unauthorized access beyond the intended session lifetime. The exact attack preconditions are not detailed, but typically require the attacker to obtain or intercept a session identifier.

Affected products

Progress MOVEit Transfer before 2025.1.6, 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.