Summary
generated automatically from NVD dataCVE-2026-89068 is an authentication flaw in the LDAP module of Progress MOVEit Transfer, caused by a missing critical step in the authentication process (CWE-304). It affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. The issue is rated HIGH with a CVSS v3.1 score of 8.1; it is network-exploitable without privileges or user interaction, though attack complexity is high, and it could heavily impact confidentiality, integrity and availability.
NVD description
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
EPSS · FIRST.org
0.46%probability of exploitation in the next 30 days
Higher than 38% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 14 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Analyzed
- Source
- security@progress.com
Affected products
Weaknesses (CWE)
References (1)
Similar CVEs
Other vulnerabilities of type CWE-304
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.