CVE-2026-89072 in MOVEit Transfer
Summary
by MITRE • 10/14/2026
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified flaw resides within the Client Certificate authentication mechanism of Progress MOVEit Transfer, a widely deployed managed file transfer solution used by enterprises for secure data exchange. This vulnerability represents an incorrect authorization issue where the application fails to properly enforce access control policies when processing client certificates during the TLS handshake or subsequent session validation phases. In typical implementations, client certificate authentication requires that the presented X.509 certificate not only be cryptographically valid and signed by a trusted Certificate Authority but also correspond to specific user accounts with defined permissions within the MOVEit Transfer database. The vulnerability arises because the software does sufficiently validate the binding between the authenticated identity derived from the certificate and the actual authorization rights assigned in the backend system, or it fails to reject certificates that have been revoked or are otherwise invalid according to strict policy enforcement rules.
From a technical perspective, this flaw allows an attacker who possesses a valid client certificate issued by the organization's internal Certificate Authority to potentially bypass intended access restrictions. If the vulnerability involves improper validation of certificate attributes such as Subject Alternative Names (SANs) or Common Names (CNs), an attacker might be able to impersonate another user whose identity is embedded in the certificate metadata, provided they hold a valid private key for that certificate. Alternatively, if the issue relates to revocation checking failures, certificates marked as revoked via Certificate Revocation Lists (CRL) or Online Certificate Status Protocol (OCSP) responses may still be accepted by the server, effectively nullifying one of the primary mechanisms for maintaining trust in public key infrastructure deployments. This misconfiguration creates a gap where authentication succeeds but authorization checks are either skipped, incorrectly evaluated, or bypassed entirely due to logic errors in the permission mapping module.
The operational impact of this vulnerability is significant given the sensitive nature of data handled by MOVEit Transfer systems. Successful exploitation could lead to unauthorized access to confidential files, allowing attackers to read, modify, or delete critical business documents without proper credentials for those specific resources. In worst-case scenarios where privilege escalation vectors are present within the broader application logic triggered by this authorization bypass, an attacker might gain administrative control over the file transfer server, leading to complete compromise of the underlying infrastructure and all data stored therein. This aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, highlighting fundamental failures in enforcing least privilege principles. The risk is further compounded by the fact that MOVEit Transfer often serves as a central hub for sensitive regulatory compliance data such as HIPAA or GDPR protected information, making any unauthorized access a severe security incident with potential legal and reputational consequences.
Mitigation strategies must prioritize immediate patching to the latest stable release of MOVEit Transfer, specifically version 2025.1.6 or later for the older branch, and version 2026.0.4 or later for the newer branch, as these versions contain code corrections that enforce strict validation logic for client certificates. Organizations should also review their certificate authority policies to ensure robust revocation checking is enabled and functioning correctly within the MOVEit environment. Implementing network-level controls such as firewall rules restricting access to the HTTPS port only from known IP ranges can provide an additional layer of defense in depth. Furthermore, security teams should audit existing client certificates for proper lifecycle management, ensuring that expired or compromised keys are promptly revoked and removed from trust stores. Continuous monitoring using intrusion detection systems configured with signatures related to ATT&CK technique T1078 Valid Accounts is recommended to detect anomalous authentication patterns resulting from this vulnerability being exploited in the wild.