CVE-2026-89075 in MOVEit Transfer
Summary
by MITRE • 10/14/2026
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical failure in data protection mechanisms within the Progress MOVEit Transfer application, specifically categorized under insecure storage of sensitive information. This flaw allows for the exposure of confidential data that should be protected through encryption or secure hashing protocols during rest. The affected versions include all releases prior to version 2025.1.6 and any release from the 2026.0 series up until, but not including, version 2026.0.4. This specific scope indicates that organizations running these older or intermediate builds are exposed to potential data leakage risks without immediate awareness if proper monitoring is not in place.
From a technical perspective, this vulnerability typically involves the storage of credentials, session tokens, personally identifiable information, or other sensitive configuration details in plaintext within local files, databases, or memory structures where they can be accessed by unauthorized processes or users with lower privilege levels than intended. In enterprise file transfer solutions like MOVEit Transfer, such data often includes database connection strings containing clear-text passwords, API keys used for integrations, or user session identifiers that could facilitate account takeover attacks if intercepted from the local storage medium. The lack of proper encryption at rest means that anyone gaining access to the underlying filesystem or backup archives can extract these secrets without needing to bypass application-level authentication controls first.
The operational impact of this vulnerability is severe due to its potential role as an initial vector for broader system compromise. Attackers who exploit insecure local storage do not necessarily need to break into the application directly; instead, they may leverage operating system vulnerabilities, misconfigured file permissions, or physical access to retrieve sensitive artifacts. Once obtained, these credentials can be used to pivot laterally across network segments, escalate privileges by accessing backend databases with administrative rights, or exfiltrate data stored within the transfer platform itself. This aligns closely with Common Weakness Enumeration CWE-312, which defines insecure storage of sensitive information as a distinct category of weakness where software stores critical data in an unprotected format that is accessible to unauthorized actors.
Furthermore, this vulnerability maps directly to several tactics and techniques within the MITRE ATT&CK framework. It facilitates the Credential Access technique T1552, specifically Unsecured Credentials, which involves gathering credentials stored on a local system or network share. By exploiting CWE-312, an adversary can achieve persistence or privilege escalation more efficiently than through brute-force methods against application login screens. The ease of access to plaintext secrets significantly lowers the barrier for entry in advanced persistent threat scenarios where stealth and speed are paramount.
Mitigation requires immediate action by upgrading the MOVEit Transfer software to version 2025.1.6 or later, or if operating on the newer architecture, ensuring an upgrade to at least version 2026.0.4. Progress has addressed these storage flaws in subsequent patches by implementing proper encryption standards for sensitive fields and enforcing stricter file permissions that restrict access to authorized service accounts only. In addition to patching, organizations should conduct a thorough audit of their current installations to identify any instances where legacy configurations might still be storing data insecurely. Implementing additional controls such as operating system-level auditing, regular rotation of stored credentials, and the use of external key management systems can provide defense-in-depth measures that mitigate the risk even if similar vulnerabilities are discovered in future updates.