CVE-2026-89071 in MOVEit Transfer
Summary
by MITRE • 10/14/2026
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical security flaw within the Lightweight Directory Access Protocol (LDAP) module of Progress MOVEit Transfer, specifically classified as an LDAP injection issue resulting from improper neutralization of special elements used in query construction. This type of weakness is formally categorized under Common Weakness Enumeration identifier CWE-90, which describes situations where software fails to properly sanitize user-supplied input before incorporating it into LDAP commands. In the context of MOVEit Transfer, this flaw likely resides within components that interact with external directory services for authentication, authorization checks, or data retrieval operations. When an application constructs an LDAP query by concatenating raw user input without adequate validation or escaping mechanisms, attackers can inject maliciously crafted characters such as parentheses, asterisks, and ampersands to alter the logical structure of the intended query. This allows the attacker to bypass access controls, extract sensitive directory information, or potentially execute arbitrary commands if the backend LDAP server supports extended operations that can be manipulated through injection vectors.
The operational impact of this vulnerability is severe due to the privileged nature of many MOVEit Transfer deployments and their frequent integration with enterprise identity management systems such as Microsoft Active Directory or OpenLDAP. An unauthenticated attacker could exploit this flaw to perform unauthorized directory enumeration, potentially revealing usernames, group memberships, and other metadata that aids in further reconnaissance attacks. More critically, if authentication logic relies on LDAP queries for validation, an injection attack could allow the adversary to bypass login mechanisms entirely by manipulating boolean conditions within the query filter. For instance, injecting a tautology such as "(objectClass=*)" might return all entries or grant access based on flawed logical evaluation. This compromises the confidentiality and integrity of user credentials and organizational data stored or processed through the MOVEit platform, potentially leading to full system compromise if combined with other vulnerabilities in the application stack.
This vulnerability affects specific versions of Progress MOVEit Transfer, namely those released before version 2025.1.6 within the legacy release line and versions from 2026.0.0 up to but not including 2026.0.4 in the newer release cycle. The presence of this flaw across multiple major version lines indicates a systemic issue in how LDAP interactions are handled throughout different iterations of the software architecture. Attackers targeting these specific builds can leverage known exploitation techniques associated with CWE-90, which often involve crafting complex filter strings that exploit parsing ambiguities or lack of strict type checking on input parameters passed to directory services. The persistence of this weakness suggests that previous remediation efforts may have addressed surface-level inputs while overlooking deeper integration points within the LDAP module's query builder logic.
Mitigation strategies must prioritize immediate patching and rigorous input validation practices. Organizations running affected versions should upgrade immediately to version 2025.1.6 or later, or version 2026.0.4 and above, where Progress has implemented fixes for this improper neutralization issue. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block common LDAP injection patterns, including unusual sequences of special characters in query parameters. Additionally, developers should enforce strict allow-listing for input fields that interact with directory services, ensuring that only expected alphanumeric values are processed while rejecting or escaping all other characters. Implementing parameterized queries or using dedicated LDAP libraries that handle encoding automatically can further reduce the risk of injection by separating code from data during query construction.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1506, which covers Data Source Impersonation and potentially T1078 if used for unauthorized access to directory services. The exploitation of LDAP injection often serves as an initial vector in broader attack chains aimed at lateral movement within enterprise networks. Security teams should monitor logs for anomalous LDAP query patterns, such as unusually long filter strings or requests containing unexpected special characters like backslashes and parentheses that deviate from normal authentication flows. Continuous monitoring combined with timely patching remains the most effective defense against this class of vulnerabilities, ensuring that the integrity of identity-based access controls is maintained across all supported versions of the MOVEit Transfer platform.