MOVEit Transfer CVE-2026-89074

Requires a valid authenticated MOVEit Transfer account (PR:L) reachable over the network (AV:N); exploitation does not need user interaction (UI:N) and targets the default application rather than a special mode. Limiting factors: the high attack complexity (AC:H) implies exploitation depends on conditions outside the attacker's control - likely precise Unicode encoding sequences that defeat the application's normalization/validation logic - and the low-privilege authentication requirement means a pre-existing or obtainable account is a prerequisite. Affected deployments are MOVEit Transfer versions before 2025.1.6 and 2026.0.0 up to (but not including) 2026.0.4.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable but non-trivial exploitation: high attack complexity (AC:H) and a required authenticated account (PR:L) both reduce real-world ease of exploitation despite the full C:H/I:H/A:H impact triad. No EPSS probability, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - these signals are simply absent, not negative. This tempers urgency relative to a wormable unauthenticated flaw. However, MOVEit Transfer is a historically high-value target for extortion groups (e.g., the 2023 Cl0p campaign), so even an authenticated, high-complexity bug warrants prompt patching in any internet-exposed deployment. Net: a genuine priority for exposed MOVEit instances, but the AC:H + PR:L requirements make mass, opportunistic exploitation less likely than targeted abuse by an attacker who already holds a low-privilege account. Note a signal conflict: the 'Information Disclosure' tag understates the CVSS vector, which asserts full confidentiality, integrity, AND availability impact - verify the true impact scope with the Progress advisory.

An attacker holding a low-privilege authenticated MOVEit Transfer account submits a request containing specially crafted Unicode-encoded input that the application fails to normalize correctly (CWE-176), causing input validation or access-control checks to be bypassed and exposing or altering protected data. Exploitation is network-reachable but of high complexity, likely requiring precise encoding manipulation and specific conditions. No public exploit code was identified in the provided data.