CVE-2026-89077 for platform teams: what to instrument before and after the upgrade

Platform teams inherit vulnerabilities with a different mandate than security teams. Neither party can hand the other a clean decision, and the CVE becomes an instrumentation project that must be finished before the patch window opens.

The two facts that drive instrumentation

CVE-2026-89077 is an incorrect implementation of an authentication algorithm in the SFTP module of Progress MOVEit Transfer, classified CWE-303, with a CVSS v3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 7.5.
Two fields matter for instrumentation. Network attack vector means reachability determines who can attempt exploitation. Low privileges required means an attacker needs a valid identity, and identity usage is something a platform team can observe if the logging exists.

Baseline the identity population

Before the upgrade, produce a list of every SFTP identity on each affected host. Include the authentication method and the last observed authentication.
Where the platform does not log authentication events with sufficient detail, that gap becomes the first project item. A flaw in validation produces a successful authentication as its observable outcome, and success events without identity and source detail are not analysable.
The list has a second use. After the upgrade, the same list is the input to credential review, and any identity that has not authenticated in a year becomes a candidate for removal rather than a permanent resident.

Instrument reachability

Reachability from untrusted networks is a property of the deployment, not the CVE. Record for each host which network paths can reach the SFTP listener and which partner address ranges are admitted.
This is the input that turns a global CVE into a local priority. An affected host with no inbound SFTP reachability is patched on the normal cycle. An affected host accepting connections from the public internet is patched in the next window.

Instrument the patch state

Track version per node, not per deployment. Clustered MOVEit installations can have members at different builds, and the load balancer hides the difference. A record that says "MOVEit, patched" without node-level detail cannot answer the question the next audit will ask.
The target versions are 2025.1.6 for the 2025.1 branch and 2026.0.4 for the 2026.0 branch. Affected ranges are before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Instrument the verification, not just the change

A change record with a build number and no behavioural confirmation is an assertion. Add two fields to the change template: the identity used for the known-good authentication test and its result, and the date the partner confirmed a successful transfer.
Those two fields convert a claim into evidence, and they cost minutes per host when collected during the window rather than weeks later during an audit.

After the upgrade

Keep authentication logging enabled at the detail level used for the investigation. The flaw is fixed on the patched host, and the log data answers a different question: whether any authentication occurred during the exposure window that policy did not expect.
Retaining that data for the exposure period plus a reasonable margin is the difference between reconstructing events and guessing at them.

The handoff

Security teams decide when a CVE matters. Platform teams produce the evidence that decision depends on: who holds identities, what reaches the listener, which nodes run which build, and what changed after the upgrade. CVE-2026-89077 is a 7.5 that becomes urgent or routine based on that evidence, and the evidence only exists if someone instruments for it.