CVE-2026-89068: a missing authentication step in the MOVEit Transfer LDAP module

Progress Software published fixes for twelve MOVEit Transfer vulnerabilities on 14 October 2026. CVE-2026-89068 carries a CVSS v3.1 base score of 8.1 and sits in the LDAP module, the component that lets the product read identity data from an external directory.
That placement is what gives the flaw its weight. A directory lookup runs before the product decides who an account is, so a weakness in that lookup can sit upstream of every authorization decision the directory informs.

Vulnerability overview

The advisory maps CVE-2026-89068 to CWE-304, a missing critical authentication step, and rates it 8.1. The report states that the flaw lets unauthenticated network attackers compromise the server, which places it among the more serious entries in the set even though it trails the two 8.8 issues.
No exploitation in the wild has been confirmed, and no public proof of concept exists. Those statements describe the vendor's current position rather than a permanent guarantee.

Mechanism and exploitation conditions

CWE-304 describes code that performs part of an authentication routine but skips a required check. In an LDAP-backed login, the expected sequence validates the connection, resolves the account, and then confirms the credentials before granting a session. The report's mapping implies one of those confirmations is absent on a reachable path, so a request that should be rejected early can continue into the server.
Because the flaw is unauthenticated, the attacker does not need a valid account first. The report does not publish the exact request that triggers the skip, the network position required, or whether a specific LDAP integration mode has to be configured. Those gaps matter for testing: a defender cannot build a precise proof from public facts alone and has to reason from the product's identity flow.

Impact

A successful bypass reaches whatever the skipped step protected. On a managed file transfer server, that can mean reading or manipulating transfers, reaching administrative functions that assume an authenticated session, or using the host as a staging point toward systems the server can reach.
The operational consequence depends on how MOVEit Transfer is deployed. An instance that terminates partner connections from the internet presents a different risk profile from one confined to an internal segment, even on identical software versions.

Affected products and scope

MOVEit Transfer versions before 2025.1.6 and versions 2026.0.0 through before 2026.0.4 are affected. Versions 2025.1.6 and 2026.0.4 are the fixed releases.
The same disclosure also closes CVE-2026-89067 and CVE-2026-87093 at 8.8, plus nine further issues across the OIDC, SFTP, Ad Hoc, Custom Reports and Client Certificates modules. A host that is behind on patching therefore carries more than this one exposure. The report does not state how many installations are affected or which directory configurations trigger the flaw.

Exposure context

A ZoomEye lookup on the product fingerprint app="MOVEit" returned 1676 matching assets, while a CVE-filtered lookup for vul.cve="CVE-2026-89073" returned 0 because the identifier is too new to be indexed. The product count describes MOVEit instances ZoomEye can observe. It does not establish that any of them are unpatched, and it says nothing about version or configuration.

Remediation and mitigations

Upgrade to 2025.1.6 or 2026.0.4 and confirm the running build afterwards rather than trusting the installer's exit code.
Where the upgrade has to wait, restrict which networks can reach the MOVEit Transfer interface, paying particular attention to directory-facing endpoints, and review directory bind accounts for more scope than the integration needs. Keep authentication logging enabled, because a skipped check is easier to detect through anomalous session behaviour than through a signature.

References

• Progress Software MOVEit Transfer bulletin, as reported by SecurityOnline, 16 October 2026: https://securityonline.info/progress-patches-moveit-transfer-vulnerabilities/
• NVD entry for CVE-2026-89068: https://nvd.nist.gov/vuln/detail/CVE-2026-89068