CVE-2026-87093 in MOVEit Transfer
Summary
by MITRE • 10/15/2026
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical misconfiguration within the access control mechanisms of Progress MOVEit Transfer, specifically categorized under CWE-732 as Incorrect Permission Assignment for Critical Resource. This flaw arises when the software fails to assign appropriate security permissions to sensitive files or directories during initialization, update processes, or runtime operations. In enterprise environments where MOVEit Transfer is deployed to manage secure file transfers between disparate systems, such a misconfiguration can expose internal data structures, configuration files, or user-uploaded content to unauthorized entities. The vulnerability affects versions prior to 2025.1.6 and the early releases of the 2026 series up to version 2026.0.4, indicating that legacy systems and recently deployed instances within this specific window remain susceptible until patched.
From a technical perspective, the root cause typically involves insufficient validation or oversight during the file system operations performed by the application service account. If the underlying operating system grants broader read, write, or execute permissions than intended to users other than the designated administrator or service account, attackers can exploit these elevated privileges. This often manifests as world-readable configuration files containing database credentials or API keys, or writable directories that allow for arbitrary file placement. Such conditions enable an attacker with local access on the host server, or potentially remote access if combined with other vulnerabilities like directory traversal, to manipulate critical resources. The lack of strict adherence to the principle of least privilege allows malicious actors to alter application behavior, steal sensitive data, or inject malicious code into processing pipelines.
The operational impact of this vulnerability is severe due to its potential for lateral movement and data exfiltration. If an attacker gains access to configuration files containing plaintext passwords or encryption keys, they can compromise the integrity of encrypted communications stored within MOVEit Transfer. Furthermore, if writable permissions are incorrectly assigned to upload directories, it may facilitate remote code execution by allowing the placement of malicious scripts that are subsequently executed by the web server process. This aligns with MITRE ATT&CK techniques such as T1530 Data from Local System and potentially T1059 Command and Scripting Interpreter if script files can be uploaded and triggered. The compromise undermines the core value proposition of MOVEit Transfer, which is secure file transfer, thereby exposing organizations to significant regulatory penalties under frameworks like GDPR or HIPAA due to unauthorized data exposure.
Mitigation strategies must prioritize immediate patching to the latest stable release outside the affected version ranges, specifically ensuring that systems are updated beyond 2025.1.6 and 2026.0.4 where these permission checks have been corrected by Progress Software. In environments where immediate patching is not feasible due to operational constraints, administrators should manually audit file system permissions on all directories associated with MOVEit Transfer installations. This includes verifying that configuration files are restricted to the service account only and that upload directories do not permit execution of uploaded content unless explicitly required for specific business functions. Additionally, implementing strict network segmentation limits lateral movement opportunities, while continuous monitoring via SIEM solutions can detect anomalous file access patterns indicative of exploitation attempts related to this permission flaw.