MOVEit Transfer CVE-2026-89068

Exploitation targets MOVEit Transfer's LDAP authentication module, so the realistic prerequisite is an instance configured to use LDAP/Active Directory external authentication (as opposed to local-only accounts) with the web interface network-reachable by the attacker. Per CVSS AV:N/AC:L/PR:N/UI:N the attack is remote, low-complexity, requires no prior credentials, and needs no user interaction - the 'missing critical step' means the authentication check can be skipped outright. The principal limiting factor is therefore the LDAP module being enabled and exposed; instances using only non-LDAP authentication or isolated from untrusted networks are not in the exploitable path. Affected: MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4; patched builds remove the exposure.

Signals conflict sharply and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) and CWE-304 (Missing Critical Step in Authentication) describe a classic remote, unauthenticated authentication-bypass with total impact - an inherently high-priority profile, especially given MOVEit Transfer's history as a mass-exploitation target. However, the real-world exploitation signals are currently cool: EPSS is only 0.46% (38th percentile), CISA SSVC records Exploitation as 'none', the CVE is NOT in CISA KEV, and no public POC is referenced. SSVC does corroborate severity with Technical Impact 'total', but rates Automatable 'no', which argues against the kind of indiscriminate worm-like scanning seen in the 2023 MOVEit/Cl0p campaign. Net assessment: this is a genuine high priority to PATCH promptly because the vulnerability class and impact are severe and the product is a known attacker magnet, but as of this analysis there is no evidence of active exploitation - the threat is latent rather than realized. Caveat: the 'Information Disclosure' tag understates the vector, which per CVSS reflects full confidentiality, integrity, AND availability compromise, i.e. authentication bypass rather than mere data leakage - treat the tag, not the CVSS, as the weaker signal.

A remote, unauthenticated attacker who can reach the MOVEit Transfer web interface sends authentication requests that skip a required verification step in the LDAP authentication module, obtaining a valid authenticated session without legitimate credentials. From that session the attacker accesses, alters, or exfiltrates transferred files and administrative functions. No public exploit code is identified at time of analysis, and CVSS AC:L indicates no special timing or race conditions are required once a reachable, LDAP-configured instance is found.