CVE-2026-89071: CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection') in Progress MOVEit Transfer

CVE-2026-89071 is an LDAP injection vulnerability (CWE-90) in the LDAP module of Progress MOVEit Transfer. The flaw arises from improper neutralization of special elements in LDAP queries, allowing an attacker with low privileges to potentially execute unauthorized LDAP operations. Affected versions include all releases before 2025.1.6 and versions from 2026.0.0 up to but excluding 2026.0.4. The vulnerability has a CVSS v3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data, so remediation status is unknown.

Successful exploitation could lead to unauthorized LDAP query manipulation, potentially compromising confidentiality, integrity, and availability of LDAP data within MOVEit Transfer. The vulnerability requires network access and low privileges but has high impact on core security properties. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the LDAP module and monitor for suspicious LDAP query activity. Avoid exposing the vulnerable versions externally.