CVE-2026-89075: CWE-922 Insecure Storage of Sensitive Information in Progress MOVEit Transfer

This vulnerability (CVE-2026-89075) in Progress MOVEit Transfer is classified as CWE-922 (Insecure Storage of Sensitive Information). It affects MOVEit Transfer versions prior to 2025.1.6 and versions from 2026.0.0 up to 2026.0.4. The CVSS v3.1 score is 7.3, indicating high severity, with attack vector local, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability. The vulnerability allows sensitive information to be stored insecurely, potentially exposing it to unauthorized access or modification.

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of sensitive information stored by MOVEit Transfer. This could result in unauthorized data disclosure, data tampering, and disruption of service. The CVSS vector indicates that an attacker with local access and low privileges could exploit this vulnerability with user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information was provided in the input data. Users should monitor Progress's official advisories for updates and apply any available fixes promptly once released.