CVE-2026-89076

MOVEit Transfer SQL injection in custom reporting

High7.2EPSS 0.52%

Published: 14 Oct 2026
Updated: 15 Oct 2026
Reserved: 10 Sept 2026
Assigned by: ProgressSoftware

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Scores

CVSS scores of CVE-2026-89076, by who scored it
Scored by	CVSS	Score	Vector
ProgressSoftwareCNA (assigner)	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.52% · top 56% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

Progress · MOVEit Transfer
- affected < 2025.1.6
- affected 2026.0.0 – < 2026.0.4

References (1)

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-89076](https://trackcve.app/badge/CVE-2026-89076.svg)](https://trackcve.app/cve/CVE-2026-89076)

Record last updated 15 Oct 2026, 03:57 UTC.