Progress MOVEit Transfer CVE-2026-89076

Exploitation requires an authenticated session with high privileges (CVSS PR:H) and access to the MOVEit Transfer Custom Reports module - this specific module is the required feature/attack surface, so deployments where report functionality is unused or restricted to a small admin set face reduced exposure. The vulnerable versions are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3 (fixed in 2026.0.4); other branches are not in scope. Limiting factors: attacker must already possess administrative/high-privilege access, which is the principal barrier; no user interaction is needed and the service is network-reachable, so an exposed internet-facing instance combined with a compromised privileged credential is the realistic risk condition.

This is a credible but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) describes network-reachable, low-complexity exploitation with no user interaction, but PR:H means the attacker must already hold high (administrative) privileges within MOVEit Transfer, which sharply limits the pool of viable attackers and is the dominant mitigating factor. All three impact dimensions are High, consistent with SQL injection (CWE-89) yielding full read/write to backend data. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit or POC was referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' A key tension to flag: MOVEit Transfer has a notorious history of mass exploitation (the 2023 Clop/CVE-2023-34362 campaign), and the vendor labels its bulletin 'Critical,' yet the actual metrics here (PR:H, no KEV, no POC, no EPSS) point to a far narrower, post-authentication risk than the unauthenticated 2023 flaw. Treat vendor 'Critical' framing and the 7.2 HIGH base score as a prompt for prompt patching of an internet-exposed enterprise product, not as evidence of active mass exploitation.

An attacker who has obtained a high-privilege MOVEit Transfer account (for example a compromised administrator credential or an insider) accesses the Custom Reports module and submits crafted input that is unsafely concatenated into an SQL query. This lets them read, modify, or destroy transfer metadata and stored data in the backend database. No public exploit code was identified at time of analysis, and exploitation requires existing high privileges, so this is not a drive-by remote-unauthenticated attack.