MOVEit Transfer CVE-2026-87093

Exploitation requires an authenticated, low-privileged user account on the MOVEit Transfer instance (PR:L) and local/session access (AV:L) - not anonymous internet exploitation. The flaw is an incorrect permission assignment (CWE-732) on a critical resource, meaning an authenticated user can reach or manipulate resources outside their intended privilege level without any user interaction (UI:N) and without special complexity (AC:L). Limiting factors that reduce real-world risk: the attacker must first obtain valid credentials or an active session, the vector is local rather than remote-network, and only MOVEit Transfer versions before 2025.1.6 and 2026.0.0 through before 2026.0.4 are affected - upgrading to 2025.1.6 or 2026.0.4 removes the condition.

Signals are mixed and point to a serious but conditional issue rather than a mass-exploitation emergency. The vendor-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a LOCAL attack vector requiring an authenticated low-privileged account, with a scope change yielding full confidentiality, integrity and availability impact - consistent with CWE-732 (Incorrect Permission Assignment) where an existing user reaches critical resources beyond their intended authorization. Note a tension worth verifying with the vendor: MOVEit Transfer is predominantly an internet-facing web/managed-file-transfer application, yet the vector specifies AV:L (local), implying the attacker must already have an authenticated session/foothold rather than exploiting purely over the network - this materially lowers real-world reachability versus the unauthenticated MOVEit flaws exploited en masse in 2023. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the SSVC framework cannot be fully evaluated without exploitation/automatable data. Given MOVEit's history as a high-value Cl0p target and the full-impact scope-changed outcome, this should be treated as a genuine priority to patch promptly, but the authentication and local-vector prerequisites make it more a targeted/post-authentication risk than a wormable, widespread one.

An attacker who already holds a valid low-privileged MOVEit Transfer account (or has compromised one) abuses the incorrectly assigned permissions on a critical resource to read, modify, or control data and functions outside their authorization, resulting in a scope change that compromises the broader system. No user interaction is required. No public exploit was identified at time of analysis, so exploitation would currently require independent development.