Progress fixes 12 MOVEit Transfer flaws allowing authentication bypass

Progress has released patches for twelve vulnerabilities in its MOVEit Transfer managed file transfer platform. The update addresses flaws that could allow attackers to bypass authentication checks and gain administrative control. According to GBHackers, the company published a critical security bulletin on 15 October 2026 urging immediate upgrades. The bulletin states that exploitation could lead to unauthorized access, data exposure and service instability.

Root cause

The primary issues stem from weaknesses in how the software handles user verification and session management. According to the NVD record, CVE-2026-89067 involves an authentication bypass using an alternate path or channel. GBHackers reports that other flaws include missing authentication steps, capture-replay weaknesses and flawed authentication algorithms. Additionally, incorrect permissions on critical resources and insufficient session expiration times create opportunities for attackers to escalate privileges or hijack active sessions.

Attack path

Attackers could chain these vulnerabilities to take over user sessions or gain administrative access. The combination of authentication bypass and privilege escalation flaws allows an adversary to reach protected functions without proper credentials. GBHackers notes that LDAP and SQL injection flaws further increase the risk of directory manipulation and database exposure. While Progress stated it had not reported exploitation in the wild at the time of the bulletin, the potential for unauthorized access remains significant.

Affected versions

The vulnerabilities affect multiple releases of the software. According to the Progress bulletin, affected versions include MOVEit Transfer 2025.0.8 and earlier. The range also covers 2025.1.0 through 2025.1.5 and 2026.0.0 through 2026.0.3. The NVD record confirms that versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 are vulnerable to the authentication bypass flaw.

Mitigation

• Upgrade to version 2025.1.6 or 2026.0.4 using the full installer.
• Plan for system outage during the upgrade process.
• Monitor logs for signs of session hijacking or unauthorized access.
• Verify that no older versions are running in the environment.

Why it matters

Authentication bypass flaws allow attackers to skip security checks designed to verify user identity. When combined with privilege escalation, these vulnerabilities can grant unauthorized users full control over a system. Teams usually prioritise patching such issues immediately because they can lead to complete compromise. Check whether your environment relies on legacy versions that may lack these critical security controls. Ensure that session management policies are robust to limit the impact of any potential hijacking.

Background: Session hijacking

Session hijacking is the theft of a valid session token to impersonate a user. It allows attackers to access accounts without knowing passwords. Defences require binding tokens to device fingerprints, enforcing short expiration times, and validating transport layer security to prevent interception.

Read the full guide: Session Hijacking Definition: How Token Theft Bypasses Login Controls

What to do and how to stay safe: Progress

• Verify your current MOVEit Transfer version against the affected list.
• Schedule an upgrade to the patched version using the full installer.
• Monitor network traffic for unusual authentication attempts or session anomalies.
• Review access logs for signs of privilege escalation or unauthorized administrative actions.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-89067?

The CVSS score for CVE-2026-89067 is 8.8, which is rated as high severity.

Are there confirmed reports of exploitation in the wild?

Progress stated in its bulletin that it had not reported exploitation in the wild.

Which versions of MOVEit Transfer are fixed?

The vulnerabilities are resolved in versions 2025.1.6 and 2026.0.4.