---
title: MOVEit Transfer: Progress fixes 11 flaws incl. Secure Messaging auth bypass (CVE-2026-89067, 8.8), LDAP sign-on bypass and email-MFA bypass; upgrade to 2025.1.6 / 2026.0.4 | ctxsec
url: https://ctxsec.com/items/moveit-transfer-oct-2026-11-cves
description: ""
status: "confirmed (Progress CVE records); no known exploitation reported; not KEV"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/moveit-transfer-oct-2026-11-cves.md)

confirmed (Progress CVE records); no known exploitation reported; not KEV

2026-10-14

### MOVEit Transfer: Progress fixes 11 flaws incl. Secure Messaging auth bypass (CVE-2026-89067, 8.8), LDAP sign-on bypass and email-MFA bypass; upgrade to 2025.1.6 / 2026.0.4

Progress published 11 MOVEit Transfer CVEs on Oct 14 (CVE-2026-89067 through -89077) under its "MOVEit Transfer Critical Security Bulletin – September 2026". All affect versions before 2025.1.6 and 2026.0.0 up to (not including) 2026.0.4. The top-rated ones: CVE-2026-89067 (CVSS 8.8), an authentication bypass through an alternate path in Secure Messaging that needs a low-privileged login; CVE-2026-89068 (8.1), an authentication bypass in LDAP sign-on; CVE-2026-89069 (8.0), stored XSS in Ad Hoc packages. A group of 7.5s covers OIDC authentication replay (-89070), LDAP injection in certificate-based authentication (-89071), an authorization flaw in client-certificate management (-89072), an OAuth access-restriction bypass (-89073), an email-MFA bypass (-89074) and an SFTP identity-validation flaw (-89077). Two more are rated lower: a SQL injection in custom reports that needs an admin (-89076, 7.2) and local disclosure of session information (-89075, 7.3). The CVE records don't mention exploitation, and none is on CISA KEV as of catalog 2026.10.16. But MOVEit is a long-standing target for data theft (Cl0p in 2023), so internet-facing servers should be upgraded first.

Sources: [Progress bulletin (Oct 2026 release)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026) · [CVE-2026-89067](https://www.cve.org/CVERecord?id=CVE-2026-89067) · [CVE-2026-89068](https://www.cve.org/CVERecord?id=CVE-2026-89068) · [CVE-2026-89074](https://www.cve.org/CVERecord?id=CVE-2026-89074) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)