CVE-2026-89068: CWE-304 Missing critical step in authentication in Progress MOVEit Transfer

This vulnerability (CVE-2026-89068) in Progress MOVEit Transfer arises from a missing critical step in the authentication process within the LDAP module. The affected versions are all releases prior to 2025.1.6 and those from 2026.0.0 up to 2026.0.4, excluding the fixed versions. The CVSS 3.1 base score of 8.1 reflects network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. No vendor advisory or patch links were provided in the input data, so patch status is not confirmed.

Successful exploitation could allow an attacker to bypass authentication controls in the LDAP module, potentially leading to unauthorized access with full confidentiality, integrity, and availability impact on the affected MOVEit Transfer system. This could compromise sensitive data and disrupt service operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MOVEit Transfer LDAP module and monitor for suspicious activity related to authentication attempts. Avoid exposing the vulnerable versions to untrusted networks.