Vulnerability in Progress MOVEit Transfer

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.8

[ Description ]Official description

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund14 Oct 2026WID-SEC-2026-3950

  Progress Software MOVEit: Multiple vulnerabilities Translated from German

  CVE-2026-89075CVE-2026-89074CVE-2026-89077+9 more CVEs

[ References ]References

• community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September…Vendor Advisory