MOVEit Transfer CVE-2026-89072

Exploitation requires an authenticated session (CVSS PR:L) - a valid, even low-privilege, MOVEit Transfer account - and network reachability to the application, specifically its Client Certificates module, which is the component carrying the incorrect authorization logic. There is no user-interaction requirement (UI:N). Limiting factors: attacker must already possess or acquire credentials (so purely unauthenticated external attackers are excluded by the vector), and only instances on affected versions (before 2025.1.6, or 2026.0.0 before 2026.0.4) are vulnerable; patched builds remove the exposure. The flaw does not depend on a non-default toggle per the available data, but the Client Certificates feature must be in use for the authorization path to be reachable.

Signals are moderately consistent and point to a serious but not emergency-level issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privileged authentication, with total impact (C:H/I:H/A:H) - consistent with CWE-863 Incorrect Authorization letting an authenticated user exceed their permissions. However, the real-world-exploitation signals are notably cooler than the 8.8 base score: EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none and Automatable: no, and the vulnerability is NOT in CISA KEV. There is no indication of public POC code. So while technical impact is 'total,' there is currently no evidence of weaponization. The one material caveat: MOVEit Transfer has a documented history of being targeted at scale (2023 campaigns), so a currently-quiet EPSS score should not be read as durable safety - this is a product class that attackers actively watch, and the PR:L prerequisite is a modest barrier (any valid, even low-privilege, account suffices). Treat as a high-priority patch for a high-value asset rather than a drop-everything zero-day; the gap between high technical severity and low observed exploitation activity is the key nuance.

An attacker who holds or obtains any low-privileged authenticated account on an exposed MOVEit Transfer instance abuses the incorrect authorization logic in the Client Certificates module to perform actions or access data beyond their assigned permissions, resulting in full read/write access to transferred files and configuration. Because the flaw is network-reachable with low attack complexity, exploitation needs no user interaction once credentials are held, though no public exploit code has been identified at time of analysis.