CVE-2026-87093: CWE-732 Incorrect Permission Assignment for Critical Resource in Progress MOVEit Transfer

This vulnerability in Progress MOVEit Transfer is classified as CWE-732, indicating incorrect permission assignment for a critical resource. It affects MOVEit Transfer versions prior to 2025.1.6 and versions 2026.0.0 through 2026.0.3. The CVSS 3.1 base score is 8.8, reflecting a high severity with attack vector local, low attack complexity, low privileges required, no user interaction, and scope changed. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

An attacker with local access and low privileges can exploit this vulnerability to gain unauthorized access or control over critical resources in MOVEit Transfer. This can result in full compromise of confidentiality, integrity, and availability of the system, potentially leading to data breaches, data manipulation, or denial of service.

The vendor has published affected versions but no explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is applied, restrict local access and monitor for suspicious activity related to permission changes on critical resources.