CVE-2026-89069: cross-site scripting in the MOVEit Transfer Ad Hoc module

An 8.0 severity rating for cross-site scripting can look generous until the context is added. CVE-2026-89069, disclosed on 14 October 2026, is a scripting flaw in the Ad Hoc module of MOVEit Transfer, and the sessions it can reach belong to users who move files for a living.

Vulnerability overview

The advisory maps CVE-2026-89069 to CWE-79 and rates it 8.0 on the CVSS v3.1 scale. CWE-79 covers improper neutralization of input during web page generation, the pattern behind stored and reflected scripting flaws.
No exploitation has been confirmed, and no public proof of concept exists for this issue.

Mechanism and exploitation conditions

A scripting flaw lets attacker-controlled markup execute in another user's browser as if it came from the application. What the script can do is the interesting part. It runs with the session that is already authenticated, so it inherits that user's permissions, cookies and access to the file transfer interface.
The public report does not describe the injection point, whether the script is stored in a transfer object or reflected from a parameter, or which fields accept the payload. Those details determine whether the flaw is triggered by a partner uploading content or by an administrator opening a page, and they are not available.

Impact

A script running in an authenticated session can act as the user it hijacks: list and download transfers, open a privileged page the role allows, or change settings. It can also be chained with a second flaw for deeper access. The consequence is bounded by what the victim account is allowed to do, so a flaw that catches an administrator is more serious than one that catches a read-only partner user.
Because the MOVEit Transfer web interface is frequently reachable by external partners, the population at risk is not limited to internal staff.

Affected products and scope

MOVEit Transfer versions before 2025.1.6 and versions 2026.0.0 through before 2026.0.4 are affected, with 2025.1.6 and 2026.0.4 as the fixed releases.
The report does not state how many installations are affected, nor which browser and role combinations are needed to trigger execution.

Exposure context

A ZoomEye lookup on app="MOVEit" returned 1676 matching assets, while a lookup on vul.cve="CVE-2026-89073" returned 0 because the identifier is too new for the index. The product count describes reachable MOVEit instances, not which of them are vulnerable or which users would be affected.

Remediation and mitigations

Upgrade to 2025.1.6 or 2026.0.4 and verify the running build afterwards.
Where the deployment can supply a content security policy, use it to reduce what injected markup can do. Review which roles can post Ad Hoc content, since a flow that lets external parties place content is a natural delivery path. Server logs capture few scripting events, so watch for sessions that change behaviour shortly after a transfer is opened rather than searching for a fixed payload.

References

• Progress Software MOVEit Transfer bulletin, as reported by SecurityOnline, 16 October 2026: https://securityonline.info/progress-patches-moveit-transfer-vulnerabilities/
• NVD entry for CVE-2026-89069: https://nvd.nist.gov/vuln/detail/CVE-2026-89069