CVE-2026-89068: CWE-304 Missing critical step in authentication in Progress MOVEit Transfer Radar - Latest Security Threats / 8h Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. (CVSS: 8.1)

CVE-2026-89068 is a high-severity vulnerability in Progress MOVEit Transfer's LDAP module caused by a missing critical step in authentication. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a CVSS score of 8.1, indicating a significant risk of confidentiality, integrity, and availability impact if exploited.

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

Machine-generated threat intelligence

This vulnerability (CVE-2026-89068) in Progress MOVEit Transfer arises from a missing critical step in the authentication process within the LDAP module. The affected versions are all releases prior to 2025.1.6 and those from 2026.0.0 up to 2026.0.4, excluding the fixed versions. The CVSS 3.1 base score of 8.1 reflects network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. No vendor advisory or patch links were provided in the input data, so patch status is not confirmed.

Successful exploitation could allow an attacker to bypass authentication controls in the LDAP module, potentially leading to unauthorized access with full confidentiality, integrity, and availability impact on the affected MOVEit Transfer system. This could compromise sensitive data and disrupt service operations.

Mitigation Recommendations

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MOVEit Transfer LDAP module and monitor for suspicious activity related to authentication attempts. Avoid exposing the vulnerable versions to untrusted networks.

Threat ID: 6acfa0f92cdf04f656905691

Added to database: 10/14/2026, 15:34:17 UTC

Last enriched: 10/14/2026, 15:48:57 UTC

Last updated: 10/14/2026, 19:00:32 UTC

Crowdsource mitigation strategies, intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Lead Pen Test Professional