CVE-2026-89069
CVE-2026-89069 · MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVSS 8.0 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
moveit transfer
- Versions
- ≥ 0, < 2025.1.6: Affected (semver)
- ≥ 2026.0.0, < 2026.0.4: Affected (semver)
Update to 2025.1.6; Update to 2026.0.4