CVE-2026-89076: SQL injection in MOVEit Transfer reporting module

MOVEit Transfer carries a SQL injection flaw, CVE-2026-89076, rated 7.2 in the Custom Reports module: an account with reporting rights can reach the database holding transfer metadata, user records and audit entries. Versions before 2025.1.6 and 2026.0.0 through 2026.0.3 are affected; fixes ship in 2025.1.6 and 2026.0.4 alongside an LDAP injection patch rated 7.5.

• CVSS 7.2: vector AV:N/AC:L/PR:H/UI:N, with high privileges the only factor lowering the score
• Fixed in 2025.1.6 and 2026.0.4; affected versions are before 2025.1.6 and 2026.0.0–2026.0.3
• The same release fixes an LDAP injection rated 7.5
• ZoomEye returns 760,697 assets matching app="MOVEit Transfer"