Is CVE-2026-89075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89075 being exploited in the wild.

How severe is CVE-2026-89075?

High severity, with a CVSS score of 7.3, published 14 October 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.6; 2026.0.0 before 2026.0.4.

Is there a fix for CVE-2026-89075?

Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89075 attacked?

It is attacked with local access.

Am I affected by CVE-2026-89075?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89075: Progress MOVEit Transfer insecure storage of sensitive information

CVE-2026-89075 · Severity: high · CVSS 7.3 · Published 2026-10-14

Progress MOVEit Transfer is a secure file transfer and sharing platform used by organizations to manage sensitive data. A vulnerability allows unauthorized access to stored sensitive information, potentially exposing confidential data to attackers. This could lead to data breaches affecting multiple users or systems relying on the platform.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-89075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89075 being exploited in the wild.
How severe is CVE-2026-89075?: High severity, with a CVSS score of 7.3, published 14 October 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.6; 2026.0.0 before 2026.0.4.
Is there a fix for CVE-2026-89075?: Yes: fixed in MOVEit Transfer 2025.1.6, 2026.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89075 attacked?: It is attacked with local access.
Am I affected by CVE-2026-89075?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MOVEit Transfer 2025.1.6, 2026.0.4

Technical details

An insecure storage vulnerability in MOVEit Transfer allows sensitive information to be stored without proper encryption or protection mechanisms. The vulnerability affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4, indicating it impacts multiple release branches. An attacker with access to the underlying storage or system files could retrieve sensitive data without authentication.

Affected products

Progress MOVEit Transfer before 2025.1.6; 2026.0.0 before 2026.0.4

Timeline

2026-10-14: disclosed

References

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.