MOVEit Transfer CVE-2026-89077

Exploitation requires valid low-privilege authenticated access to the MOVEit Transfer SFTP module (CVSS PR:L), and the SFTP transfer module must be deployed/enabled, since the flaw lies specifically in that module's authentication algorithm implementation (CWE-303). The attack is remote over the network (AV:N) with low complexity (AC:L) and no user interaction, so once an attacker has any SFTP account the barrier is low. Limiting factors for defenders: an initial foothold credential is mandatory (not unauthenticated), exposure is confined to installations exposing the SFTP service, and only versions before 2025.1.6 and 2026.0.0-2026.0.3 are affected - patched builds (2025.1.6+, 2026.0.4+) remove the condition.

Signals are consistent and point to a serious-but-not-emergency priority. The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, with total impact to confidentiality, integrity and availability - matching CWE-303 (incorrect implementation of an authentication algorithm) in the SFTP module and SSVC's 'Technical Impact: total' rating. Exploitation-likelihood signals, however, are all low: EPSS is only 0.39% (32nd percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', the CVE is NOT in CISA KEV, and no public exploit code is identified. There is no conflict between signals - a genuinely dangerous technical impact combined with no evidence of current exploitation. The main nuance is that MOVEit Transfer has a notable history of mass exploitation (e.g., the 2023 Cl0p campaigns), so despite low EPSS today, an authentication-algorithm flaw in this specific product warrants prompt patching rather than deferral. Note the 'Information Disclosure' tag understates scope: the vector and CWE indicate an authentication weakness yielding full CIA impact, not merely disclosure - treat it as an authentication integrity issue.

An attacker holding valid but low-privilege MOVEit Transfer SFTP credentials connects to the SFTP service and abuses the flawed authentication algorithm to authenticate as, or gain the access of, another user, reaching files and functions beyond their authorization. Because scope is unchanged but impact is total, the attacker can read, alter, or destroy transferred data within the application. No public exploit code or active exploitation is identified at the time of analysis, so this remains a theoretical-but-credible scenario.