Is CVE-2026-89074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89074 being exploited in the wild.

How severe is CVE-2026-89074?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89074?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89074 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-89074?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89074: Progress MOVEit Transfer unicode encoding handling vulnerability

CVE-2026-89074 · Severity: high · CVSS 7.5 · Published 2026-10-14

Progress MOVEit Transfer is a managed file transfer solution used by enterprises to securely exchange data. A unicode encoding handling flaw in the software could allow attackers to bypass security controls or execute unauthorized actions, compromising the integrity and confidentiality of transferred files.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89074 being exploited in the wild.
How severe is CVE-2026-89074?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89074?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89074 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-89074?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

An improper handling of unicode encoding vulnerability exists in MOVEit Transfer. The vulnerability affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4. While the exact attack vector is not detailed in the advisory excerpts provided, improper unicode handling typically enables encoding-based bypass attacks against input validation or file processing logic.

Affected products

Progress MOVEit Transfer before 2025.1.6 and from 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.