Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-89070 is a high-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Progress Moveit Transfer. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-101150
Vulnerability Data
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
A.8.28's secure design/architecture and threat modelling guidance (planning item g) and its prohibition on insecure design techniques can catch capture-replay during design, but the clause mandates a fallible practice whose effect depends on developer rigour, so only a minority of instances are prevented.
A.8.5 addresses several vectors relevant to capture-replay: item (j) bars cleartext password transmission, items (k) and (l) shorten the window via session termination and connection-duration limits, and the strong-authentication and MFA guidance (certificates, smart cards, tokens) typically carries replay protection as part of those mechanisms. But the clause does not mandate anti-replay primitives (nonces, timestamps, challenge-response) at the protocol level, and for non-critical systems password-only authentication remains acceptable, so a system compliant with A.8.5 can still be vulnerable to capture-replay — the remainder is nameable and not bounded to a vanishing slice.
A.8.8's reach is DISCLOSURE-based, and CWE-294 does surface as CVEs (observed examples include CVE-2005-3435 and CVE-2007-4961), so vulnerability scanning, advisory tracking, and external reports will surface some instances; the disclosed share of any weakness class is a minority, capping the rung at `partial`.