Security1 hOctober 18, 2026, 06:01

MOVEit Transfer auth bypass CVE-2026-89068 threatens supply chains

Progress MOVEit Transfer's LDAP module has a missing authentication step (CWE-304, CVSS 8.1, remote unauthenticated). Builds before 2025.1.6 and 2026.0.0–2026.0.3 are affected; fixes are in 2025.1.6 and 2026.0.4. No exploitation was confirmed at publication.

DEV Community

Open source

MOVEit Transfer auth bypass CVE-2026-89068 threatens supply chains

CVSS 8.1, remote unauthenticated vector, CWE-304 class
Affected builds: before 2025.1.6 and 2026.0.0–2026.0.3
Fixed in 2025.1.6 and 2026.0.4; no exploitation confirmed
Risk extends to every partner file-transfer channel

#MOVEit#Progress

watchTowr finds pre-auth RCE chain in Progress ShareFile

Security

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

Security

MarkLogic privilege escalation chain reaches database admin from query access

Security

MOVEit Transfer auth bypass CVE-2026-89068 threatens supply chains

watchTowr finds pre-auth RCE chain in Progress ShareFile

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

MarkLogic privilege escalation chain reaches database admin from query access

Citrix NetScaler CVE-2026-19490 and CVE-2026-19489: critical auth bypass and DoS