DEV Community

yutianle
yutianle

Posted on

MOVEit Transfer authentication bypass under CVE-2026-89067: what changed in 2025.1.6 and 2026.0.4

#security #vulnerability #moveit #filetransfer

MOVEit Transfer authentication bypass under CVE-2026-89067: what changed in 2025.1.6 and 2026.0.4

Progress Software released fixes for twelve MOVEit Transfer vulnerabilities on 14 October 2026. One of the two issues rated 8.8 on the CVSS v3.1 scale is CVE-2026-89067, an authentication bypass in the Secure Messaging component.

MOVEit Transfer is an enterprise managed file transfer product, so it usually sits between internal systems and external partners. A bypass at the login boundary is worth reading about even when no exploitation has been confirmed, because the data behind that boundary is often regulated or contractually protected.

The flaw

The advisory maps CVE-2026-89067 to CWE-288, which covers authentication bypass using an alternate path or channel. That class of defect means the application enforces authentication on the intended code path but leaves a second path that reaches the same protected function without the same check. A remote attacker who holds a low-privileged account can use that alternate route to move past authentication rather than attack the credential check directly.

The public report does not describe the exact request sequence, and there is no public proof of concept. That gap matters. It limits how precisely a defender can test for the bypass, and it means detection has to rely on behavior rather than a known signature.

Impact

A successful bypass gives an attacker the access the bypassed control was meant to protect. For a transfer server that can mean reading or manipulating files, reaching administrative functions that assume an authenticated session, or using the server as a staging point toward connected systems. The operational consequence depends on how much authority the reachable function carries, which varies by deployment.

Progress has stated that no exploitation in the wild has been confirmed and that no public proof of concept exists. Treat those statements as the current position, not a permanent guarantee.

Affected products and scope

MOVEit Transfer versions before 2025.1.6 and versions 2026.0.0 through before 2026.0.4 are affected. Versions 2025.1.6 and 2026.0.4 are the fixed releases. The wider disclosure spans twelve CVEs across the LDAP, OIDC, SFTP, Ad Hoc, Custom Reports and Client Certificates modules, so a host that is behind on patching may be exposed to more than this one issue.

The report does not state how many installations are affected, and it does not provide a per-deployment configuration list.

Exposure context

A ZoomEye query against the product fingerprint app="MOVEit" returned 1676 matching assets. A CVE-filtered query for vul.cve="CVE-2026-89073" returned 0, which is expected for a freshly disclosed identifier that search engines have not yet indexed.

The product count describes MOVEit assets that ZoomEye can see. It does not confirm that any of them are vulnerable to CVE-2026-89067, and it does not describe version, patch level or configuration.

Remediation and validation

Upgrade to 2025.1.6 or 2026.0.4 from the vendor's fixed releases. After the upgrade, confirm the running build rather than trusting the installer output alone.

Where an immediate upgrade is not possible, restrict administrative console access to trusted networks and review which accounts hold low-privilege roles, since the bypass assumes an attacker can obtain one. Audit local server directory permissions as well, because the same disclosure includes a privilege escalation issue tied to incorrect permission assignments.

Because the mechanism is not public, keep a short detection plan: alert on authenticated-session anomalies and on access to Secure Messaging functions from accounts that should not reach them.

References

Top comments (0)