Security1 hOctober 18, 2026, 02:40

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

Progress Software disclosed CVE-2026-89069 (CWE-79, CVSS 8.0), a cross-site scripting flaw in the Ad Hoc module of MOVEit Transfer. The script runs in an authenticated user's session and can reach file transfers. Versions before 2025.1.6 and 2026.0.0–2026.0.3 are affected; fixes are in 2025.1.6 and 2026.0.4.

DEV Community

Open source

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

CVSS 8.0, CWE-79, disclosed October 14, 2026
Affects versions before 2025.1.6 and 2026.0.0–2026.0.3
Fixed in 2025.1.6 and 2026.0.4
ZoomEye found 1,676 reachable MOVEit instances

#MOVEit#Progress

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

Security

watchTowr finds pre-auth RCE chain in Progress ShareFile

Security

Telegram Desktop HTML export stored XSS went unnoticed for 2.5 years

Security

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

watchTowr finds pre-auth RCE chain in Progress ShareFile

Telegram Desktop HTML export stored XSS went unnoticed for 2.5 years

Drupal Webform XSS CVE-2026-96367 hits custom attributes editor