Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Progress Software
- Product
- MOVEit / WhatsUp Gold / Telerik / Kemp
- CVSS
- 8.8
- EPSS
- 0.005 (p45)
- Exposure class
- File transfer
Why it ranks 22 (Routine)
- CVSS 8.8 high
- Exposed product class: file transfer
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-89067 on this site · NVD · CVE.org · Vulnpedia