Progress published 11 MOVEit Transfer CVEs on Oct 14 (CVE-2026-89067 through -89077) under its "MOVEit Transfer Critical Security Bulletin – September 2026". All affect versions before 2025.1.6 and 2026.0.0 up to (not including) 2026.0.4. The top-rated ones: CVE-2026-89067 (CVSS 8.8), an authentication bypass through an alternate path in Secure Messaging that needs a low-privileged login; CVE-2026-89068 (8.1), an authentication bypass in LDAP sign-on; CVE-2026-89069 (8.0), stored XSS in Ad Hoc packages. A group of 7.5s covers OIDC authentication replay (-89070), LDAP injection in certificate-based authentication (-89071), an authorization flaw in client-certificate management (-89072), an OAuth access-restriction bypass (-89073), an email-MFA bypass (-89074) and an SFTP identity-validation flaw (-89077). Two more are rated lower: a SQL injection in custom reports that needs an admin (-89076, 7.2) and local disclosure of session information (-89075, 7.3). The CVE records don't mention exploitation, and none is on CISA KEV as of catalog 2026.10.16. But MOVEit is a long-standing target for data theft (Cl0p in 2023), so internet-facing servers should be upgraded first.