MOVEit Transfer CVE-2026-89073

The flaw is CWE-613 Insufficient Session Expiration: MOVEit Transfer does not reliably invalidate user sessions/tokens when it should (e.g. after logout, timeout, or credential change), so a session remains usable past its intended lifetime. The concrete prerequisite - not detailed in the terse vendor description - is that the attacker must first obtain a still-valid session artifact (a token captured in transit, left on a shared or public machine, or not revoked after logout); the CVSS PR:N reflects that the attacker needs no account of their own, only the leftover token. Limiting factors: exploitation depends on a valid session token existing and being reachable by the attacker, which is why realistic risk (and the low EPSS) is lower than the 9.8 implies; it does not grant code execution on its own.

Signals are sharply divided for this CVE. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) describes a trivially remote, unauthenticated, full-compromise flaw, and the SSVC Technical Impact is rated 'total'. However, every exploitation-likelihood signal points the other way: EPSS is only 0.31% (23rd percentile), there is no CISA KEV listing, no public POC was provided, and SSVC explicitly records Exploitation: none and Automatable: no. This is a classic 'high-CVSS, currently-low-real-risk' profile - serious in theory but with no evidence of active or imminent exploitation at analysis time. There is also an internal data conflict worth flagging: the weakness is CWE-613 (Insufficient Session Expiration), which by definition presupposes an attacker who already possesses a session token that should have been invalidated, yet the CVSS vector claims PR:N (no privileges) and A:H (full availability impact). A pure session-expiration flaw rarely yields availability impact, so the 9.8 score with C:H/I:H/A:H appears inflated relative to the CWE - verify the true impact and prerequisites with Progress. Given MOVEit Transfer's history as a mass-exploitation target (Cl0p 2023), this should be patched promptly despite the low EPSS, but it does not currently warrant emergency, drop-everything handling.

An attacker who obtains a MOVEit Transfer session token that the server failed to invalidate - for example a token left active after logout, password change, or on a shared workstation - replays it to resume the victim's authenticated session and access or manipulate transferred files. No public exploit code was identified at the time of analysis, and the reused session is unauthenticated from the attacker's own standpoint per the CVSS vector. Realistic impact is account/session takeover rather than the pre-authentication remote code execution the raw 9.8 might suggest.