External risk intelligence

MOVEit Transfer LDAP Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89068

MOVEit Transfer is a managed file transfer solution designed to be internet-facing for external partner and client file exchanges. As a gateway for data movement, it is typically deployed as a public-facing service to facilitate these transfers, making its authentication and external-facing modules highly reachable from the public internet by design.

Progress Moveit Transfer

before 2025.1.62026.0.0 to before 2026.0.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Progress MOVEit Transfer, specifically within its LDAP authentication module. This flaw could allow unauthorized access to the system, impacting the confidentiality, integrity, and availability of data. The primary concern is to confirm if our organization utilizes this specific software and if it is exposed to external networks.

Authentication weakness in file transfer software.
Confirms basic exposure and relevance to leadership.
Verify software use and external access.

Attack Path

How an attacker could exploit the issue

An attacker could target the MOVEit Transfer's LDAP module from the internet. If successful, this could lead to a compromise of sensitive information and system control.

Requires network access, no authentication needed.
Exploits a missing authentication step in LDAP.
Allows full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A missing authentication step in the LDAP module of MOVEit Transfer could allow unauthorized access to the system. This could potentially expose sensitive information handled by the application when accessed by unauthenticated attackers.

System authentication and access.
Unauthenticated network access.
Sensitive data exposure and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Progress MOVEit Transfer LDAP module requires immediate attention from teams managing file transfer infrastructure. The first practical step is to identify all instances of MOVEit Transfer within your environment, confirm their network exposure and business criticality, and then locate the specific application or infrastructure owner responsible for remediation planning.

Identify and assess MOVEit Transfer instances.
Verify external reachability and business impact.
Confirm ownership for risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MOVEit Transfer?

Progress MOVEit Transfer is a managed file transfer application used by organizations to securely share, store, and exchange sensitive files with external partners, clients, or internal departments. It acts as a centralized gateway for data movement, often serving as the primary bridge for automated and manual file transfers across a network.

What does CWE-304 mean for CVE-2026-89068?

CWE-304, or Missing Critical Step in Authentication, refers to a breakdown in the software's verification logic. For CVE-2026-89068, this means the LDAP module fails to properly validate credentials during the login process. Because the application skips this essential check, an attacker can potentially interact with the system as if they were a legitimate user without providing a valid password or token.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the MOVEit Transfer LDAP module over a network connection. Since the system fails to perform the required authentication check, the bug can be triggered by unauthenticated requests. It is important to note that this issue is specific to the LDAP authentication flow and does not inherently affect other, non-LDAP authentication methods configured within the application.

Is my MOVEit Transfer instance at risk?

Halo Surface Signal indicates that MOVEit Transfer is frequently deployed as an internet-facing service to support external file exchanges, which makes this vulnerability highly relevant. If your instance is reachable from the public internet, it faces a higher likelihood of discovery and targeting compared to systems restricted to internal network segments.

What are the first steps to address this CVE?

Begin by auditing your infrastructure to locate all instances of MOVEit Transfer. Determine which systems are internet-facing versus those restricted to internal networks to prioritize your efforts. Finally, identify the internal owners for these specific applications so you can coordinate the necessary updates to the supported versions listed in the advisory.

References

community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.