Security1 hOctober 19, 2026, 19:20

Analysis: MOVEit Transfer threat model unchanged since 2023

A structural reading of Progress's September 2026 MOVEit Transfer bulletin: 12 CVEs fall into four families, with identity flaws the largest group (CVE-2026-89067, -89068, -89070, -89072, -89073, -89074). ZoomEye returned 1,677 assets for app="MOVEit" and 546 for title="MOVEit Transfer".

DEV Community

Open source

Analysis: MOVEit Transfer threat model unchanged since 2023

12 vulnerabilities shipped in a single Progress advisory in September 2026
Six CVEs are identity-related, including an email MFA bypass via Unicode handling
CVE-2026-89069 is a stored XSS in Ad Hoc rated 8.0
ZoomEye: 1,677 assets for app="MOVEit", 546 for title="MOVEit Transfer"

#MOVEit#Progress#ZoomEye

Reading CVE-2026-89070 correctly: what the MOVEit Transfer record confirms

Security

CVE-2026-89076: SQL injection in MOVEit Transfer reporting module

Security

MOVEit Transfer auth bypass CVE-2026-89068 threatens supply chains

Security

Analysis: MOVEit Transfer threat model unchanged since 2023

Reading CVE-2026-89070 correctly: what the MOVEit Transfer record confirms

CVE-2026-89076: SQL injection in MOVEit Transfer reporting module

MOVEit Transfer auth bypass CVE-2026-89068 threatens supply chains

CVE-2026-89069: XSS in MOVEit Transfer Ad Hoc module