MOVEit Transfer CVE-2026-89075

Requires local access to the MOVEit Transfer host with an authenticated low-privilege account (AV:L, PR:L) plus user interaction (UI:R); it is NOT remotely exploitable by an unauthenticated attacker. The specific insecurely-stored artifact (credentials, keys, or configuration secrets) and whether a particular feature or deployment mode must be enabled are not detailed in the sparse description - verify the exact affected storage location and any configuration preconditions against the Progress September 2026 bulletin. Limiting factors that reduce real-world risk: mandatory local presence, pre-existing privileges, and required user interaction.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) describes a locally-exploitable issue requiring an authenticated low-privilege account AND user interaction - a markedly different risk profile from the remote, unauthenticated CVEs (e.g. CVE-2023-34362) that made MOVEit Transfer infamous. This is an Insecure Storage of Sensitive Information flaw (CWE-922), so the realistic primary consequence is confidentiality loss; the I:H/A:H ratings in the input look inflated for a storage-disclosure weakness and should be verified against the vendor advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no signal of active exploitation. Net assessment: despite the MOVEit product's high-value reputation, the local vector plus required privileges and user interaction make this a lower real-world priority than the CVSS 7.3 and the vendor's 'Critical' bulletin title suggest - patch on a normal cycle unless the vendor confirms a remote or default-config exploitation path. Note the conflict: the vendor advisory is titled a 'Critical Security Bulletin' while the supplied CVSS is only 7.3 (High) and local - resolve this discrepancy with Progress before prioritizing.

A low-privilege user or local attacker on a MOVEit Transfer host locates sensitive data (such as credentials, keys, or configuration secrets) that the application stored without adequate protection, then reads it to facilitate further compromise. Exploitation requires local access, an existing low-privilege account, and some user interaction (UI:R), and no public exploit code was provided for this analysis.