CVE-2026-89067: CWE-288 Authentication bypass using an alternate path or channel in Progress MOVEit Transfer

This vulnerability (CVE-2026-89067) in Progress MOVEit Transfer involves an authentication bypass via an alternate path or channel, classified under CWE-288. It affects MOVEit Transfer versions prior to 2025.1.6 and versions starting from 2026.0.0 up to 2026.0.4. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild are reported. The vulnerability allows an attacker to bypass authentication controls, potentially gaining unauthorized access.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms in MOVEit Transfer, leading to unauthorized access with potential full control over the affected system's confidentiality, integrity, and availability. This could result in data breaches, unauthorized data modification, or service disruption.

A fix is available in MOVEit Transfer versions 2025.1.6 and 2026.0.4 and later. Users should upgrade to these versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's official patches. Patch status is confirmed by the affected version ranges indicating fixed versions.