Security2 hOctober 19, 2026, 09:40

Reading CVE-2026-89070 correctly: what the MOVEit Transfer record confirms

An analysis of the CVE-2026-89070 record shows MOVEit Transfer before 2025.1.6 and 2026.0.0–2026.0.3 has an OIDC authentication bypass via capture-replay (CWE-294) rated 7.5. The record does not identify the failed freshness control and does not confirm exploitation or public PoC code.

DEV Community

Open source

Reading CVE-2026-89070 correctly: what the MOVEit Transfer record confirms

CVE-2026-89070: CWE-294 in MOVEit Transfer OIDC module, CVSS 7.5
Affected: before 2025.1.6 and 2026.0.0–2026.0.3; fixed in 2025.1.6 and 2026.0.4
Record names no failed control and confirms no exploitation
ZoomEye: 1,676 assets match the MOVEit fingerprint, patch level unknown

#MOVEit#Progress

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

Security

CVE-2026-89076: SQL injection in MOVEit Transfer reporting module

Security

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

Security

Reading CVE-2026-89070 correctly: what the MOVEit Transfer record confirms

CVE-2026-89070: MOVEit Transfer auth bypass via replayed OIDC sessions

CVE-2026-89076: SQL injection in MOVEit Transfer reporting module

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module

watchTowr finds pre-auth RCE chain in Progress ShareFile