MOVEit Transfer CVE-2026-89071

Exploitation requires (1) a MOVEit Transfer deployment configured to use the LDAP authentication/directory module - this is an optional integration, not a universal default, which narrows the exposed population; and (2) a valid authenticated low-privilege account on the target instance (CVSS PR:L), so this is not a pre-authentication flaw. The AC:H rating further indicates the attacker must satisfy specific, non-trivial conditions in how user input flows into the constructed LDAP query, meaning exploitation is not reliably repeatable against arbitrary inputs. Primary limiting factors for defenders: LDAP module must be enabled/configured, attacker must already be authenticated, and only versions before 2025.1.6 or in the 2026.0.0-2026.0.3 range are affected.

The vendor-supplied CVSS 3.1 score of 7.5 (HIGH) is built on AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable but requires an already-authenticated low-privilege account (PR:L) and carries high attack complexity (AC:H) - both of which materially temper the headline score. No EPSS probability, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. However, context matters: MOVEit Transfer is a historically high-value target (the 2023 Cl0p mass-exploitation campaign against CVE-2023-34362 demonstrated that threat actors actively monitor and weaponize MOVEit flaws rapidly), so a HIGH-severity vulnerability here warrants faster remediation than the raw signals alone suggest. Counterbalancing this, the AC:H + PR:L combination makes mass, unauthenticated, Internet-scale exploitation unlikely; realistic abuse requires a foothold and specific conditions. Key missing data to note explicitly: EPSS and POC status are absent from the input and cannot be confirmed either way, so likelihood of near-term exploitation is inferred, not measured.

An attacker who already holds valid low-privilege credentials on a MOVEit Transfer instance configured for LDAP-backed authentication submits crafted input containing special LDAP metacharacters that are not properly neutralized before being embedded in an LDAP query. By manipulating the query logic, the attacker can extract directory attributes they should not see or subvert the query's intended filter. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation depends on specific conditions in how the LDAP module constructs queries.