MOVEit Transfer CVE-2026-89069

Exploitation requires valid authenticated access to MOVEit Transfer (PR:L) - specifically the ability to submit content through the Ad Hoc Transfer module - plus user interaction (UI:R): a victim must view the attacker-controlled content in the web UI for the payload to fire. Impact is maximized when the viewing victim is a high-privilege operator or administrator. Limiting factors: attacker must already hold a MOVEit account, the payload only triggers on victim rendering, and only MOVEit Transfer versions before 2025.1.6 and 2026.0.0 before 2026.0.4 are affected. Not exploitable pre-authentication and not against patched builds.

Vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates a network-reachable but authenticated (PR:L) stored/reflected cross-site scripting flaw in the MOVEit Transfer Ad Hoc module requiring victim interaction (UI:R). No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The high C:H/I:H/A:H impact rating is unusual for a classic CWE-79 XSS and likely reflects Progress modeling full account/session compromise via a privileged admin or operator victim rather than direct host impact - treat the impact metrics as vendor-asserted, not independently verified. Signal-wise this is a credible patch priority given MOVEit's history of being heavily targeted and its sensitive file-transfer role, but the requirement for valid low-privilege credentials AND user interaction meaningfully lowers real-world risk versus an unauthenticated RCE; there is no evidence of active exploitation in the data supplied. Net: elevated priority for MOVEit operators, but not an emergency-grade unauthenticated bug absent KEV/POC confirmation.

An authenticated low-privilege MOVEit user submits an Ad Hoc transfer or message containing a crafted script payload in a field that is not properly neutralized. When a higher-privileged user or administrator views that content in the web interface, the script executes in their browser session, enabling session-token theft or actions performed as the victim. No public proof-of-concept was identified in the provided data.