CVE-2026-89073 in MOVEit Transfer
Summary
by MITRE • 10/14/2026
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability within the Progress MOVEit Transfer application represents a critical failure in session management protocols, specifically categorized under CWE-613 as Insufficient Session Expiration. This flaw allows active user sessions to persist beyond their intended lifespan or until manual logout occurs, thereby expanding the window of opportunity for attackers to exploit stolen credentials or hijacked session tokens. The vulnerability impacts versions of MOVEit Transfer prior to 2025.1.6 and those in the 2026.0 release stream before version 2026.0.4. In enterprise environments where MOVEit is frequently deployed as a central hub for secure file transfer, such session management deficiencies can have severe consequences regarding data confidentiality and integrity.
From a technical perspective, this vulnerability stems from the application's failure to enforce strict timeout policies on authenticated sessions after periods of inactivity or upon specific state changes. When a user logs into MOVEit Transfer, the system issues an authentication token that remains valid indefinitely unless explicitly invalidated by the server or the client. This design choice deviates from security best practices which dictate that session tokens should have a finite lifetime and be subject to automatic expiration after a defined period of inactivity. By allowing sessions to remain active for extended durations, the application increases the risk associated with credential theft via phishing, keylogging, or network sniffing attacks. If an attacker obtains valid credentials or intercepts a session cookie during this prolonged window, they can maintain persistent access to the system without needing to re-authenticate, effectively bypassing multi-factor authentication mechanisms that might otherwise limit initial access attempts.
The operational impact of insufficient session expiration is multifaceted and potentially devastating for organizations relying on MOVEit Transfer for sensitive data exchange. Attackers leveraging this vulnerability can engage in unauthorized file transfers, exfiltrating confidential documents or injecting malicious files into the system. This aligns with MITRE ATT&CK techniques such as T1078 Valid Accounts, where adversaries use legitimate credentials to maintain access, and potentially T1530 Data from Local System Extraction if they proceed to harvest data stored within the application's repositories. The persistence of these sessions means that even after a user has logically logged out or left their workstation unattended, the session remains active on the server side, allowing remote exploitation without physical proximity to the victim’s device. This significantly lowers the barrier for entry and increases the likelihood of successful compromise in environments where users may forget to log off properly.
Mitigation strategies must focus on immediate patching as well as architectural hardening. The primary remediation is to upgrade MOVEit Transfer to version 2025.1.6 or later, or if operating within the newer release cycle, to version 2026.0.4 or higher, where these session management controls have been rectified by Progress Software. In addition to patching, organizations should implement robust identity and access management practices that complement application-level security. This includes enforcing short-lived session timeouts through server configuration settings if available, requiring re-authentication for sensitive operations such as file deletion or administrative changes, and integrating with external authentication providers like SAML or OAuth2 which often handle token expiration more rigorously than native implementations. Furthermore, deploying Web Application Firewalls can help detect anomalous behavior associated with long-lived session abuse, providing an additional layer of defense against exploitation attempts while the underlying vulnerability is addressed through software updates.