12 MOVEit Flaws Enable Auth Bypass, Admin Takeover; Updates Available Now

Progress Software released a critical security bulletin on October 15, 2026, addressing 12 vulnerabilities in its MOVEit Transfer managed file transfer platform. The update resolves flaws that could allow attackers to bypass authentication, hijack sessions, and gain administrative control over the system. According to GBHackers, the company urges customers to upgrade immediately to mitigate risks of unauthorized access and data exposure.

Which versions are affected by these vulnerabilities?

The September 2026 critical security bulletin from Progress Software identifies MOVEit Transfer versions 2025.0.8 and earlier as affected. It also lists versions 2025.1.0 through 2025.1.5 and 2026.0.0 through 2026.0.3 as vulnerable. Organizations running any of these builds are exposed to the 12 reported flaws. The National Vulnerability Database records CVE-2026-89067 as affecting versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

What do the highest-severity flaws enable?

Two vulnerabilities, CVE-2026-89067 and CVE-2026-87093, both carry a CVSS score of 8.8, rated as HIGH. CVE-2026-89067 allows attackers to reach protected functions via an alternate path or channel, effectively bypassing authentication. The second flaw involves incorrect permissions on a critical resource, which can enable privilege escalation. GBHackers reports that chaining these bugs could lead to full administrative access or session takeover.

How should teams remediate the issue?

Progress states that upgrading with the full installer is the only way to fix these issues. This process causes a system outage, requiring planned maintenance windows. All 12 CVEs are resolved in versions 2025.1.6 and 2026.0.4. Defenders should prioritize this upgrade due to the potential for service instability, resource exhaustion, and directory manipulation via LDAP and SQL injection flaws included in the batch.

Is there evidence of active exploitation?

Progress had not reported exploitation in the wild in the bulletin text provided to GBHackers. However, given MOVEit’s history with the 2023 Cl0p campaign, defenders should treat authentication flaws as high priority. The vendor’s bulletin warns that exploitation could lead to data loss and service interruptions. The absence of confirmed wild exploitation does not negate the critical nature of the administrative access risks.

Detection notes

Security operations teams should monitor for anomalous login patterns and unexpected administrative activity on MOVEit Transfer servers. Look for successful authentications from unfamiliar IP addresses or at unusual times. Check for session tokens being used by multiple users simultaneously, which may indicate hijacking.

Review application logs for errors related to authentication failures or LDAP queries. If suspicious activity is detected, isolate the server from the network immediately to prevent lateral movement. Verify file integrity against known good states and preserve logs for forensic analysis. Do not rely solely on perimeter alerts, as internal pivoting may bypass network controls.

Background: Security bulletins

A security bulletin is a formal notice from a vendor detailing a vulnerability, its severity, and the required fix. It serves as the bridge between a discovered flaw and your remediation process. You must parse the technical details to determine if the issue affects your specific configuration before applying the associated patch.

Read the full guide: How Security Bulletins Work: The Hidden Mechanics of Patch Intelligence

What to do and how to stay safe: Progress

• Inventory all MOVEit Transfer installations to identify if they are running versions prior to 2025.1.6 or 2026.0.4.
• Schedule a maintenance window to apply the full installer upgrade to versions 2025.1.6 or 2026.0.4.
• Monitor authentication logs and session activity for signs of bypass attempts or unauthorized administrative access.
• Review LDAP and database access logs for injection attempts or unusual queries that could indicate exploitation.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-89067?

CVE-2026-89067 has a CVSS score of 8.8, which is rated as HIGH severity.

Can I patch these vulnerabilities with a quick fix?

No, Progress states that upgrading with the full installer is the only remediation method, which causes a system outage.

Which researchers reported these flaws?

Researchers including Leo Oliver, Maciej Nowak, Matt Grover, Mateusz Mieczkowski, Ryan Vinton, and the AI platform bugbunny.ai reported the flaws.