Summary
generated automatically from NVD dataCVE-2026-89073 is an insufficient session expiration flaw (CWE-613) in Progress MOVEit Transfer, meaning sessions may stay valid longer than they should. It affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4. The CVSS v3.1 score is 7.5 (HIGH), with a network attack vector, high attack complexity, and user interaction required. The vector rates the impact on confidentiality, integrity and availability as high.
NVD description
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
EPSS · FIRST.org
0.31%probability of exploitation in the next 30 days
Higher than 22% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 14 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Analyzed
- Source
- security@progress.com
Affected products
Weaknesses (CWE)
References (1)
Similar CVEs
Other vulnerabilities of type CWE-613
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.