Security Resilience

CVE-2026-89073

Progress Moveit Transfer ≤ 2025.1.6

Published
14 October 2026
Modified
19 October 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0040 34th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-89073 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Progress Moveit Transfer. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud Accounts (T1078.004); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-12 (Session Termination) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CWE(s)
CWE-613

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1078.004 Cloud Accounts Stealth
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1548.003 Sudo and Sudo Caching Privilege Escalation
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.
attack.mitre.org →
T1550.001 Application Access Token Lateral Movement
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1584.006 Web Services Resource Development
Adversaries may compromise access to third-party web services that can be used during targeting.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-15967Same product: Progress Moveit Transfer
CVE-2026-15966Same product: Progress Moveit Transfer
CVE-2026-89077Same product: Progress Moveit Transfer
CVE-2026-89071Same product: Progress Moveit Transfer
CVE-2025-11235Same product: Progress Moveit Transfer
CVE-2026-89067Same product: Progress Moveit Transfer
CVE-2026-8651Same product: Progress Moveit Transfer
CVE-2026-89074Same product: Progress Moveit Transfer
CVE-2026-89068Same product: Progress Moveit Transfer
CVE-2026-89070Same product: Progress Moveit Transfer

Affected Assets

progress
moveit transfer
≤ 2025.1.6 · 2026.0.0 — 2026.0.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-12 Session Termination partial match

AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.AA-01 mostly match
blocks

Credential lifecycle management directly includes enforcing session expiration to prevent reuse.

PR.AA-05 mostly match
blocks

Authorization policy enforcement and review covers terminating stale sessions to limit access scope.

PR.AA-03 partial match
blocks

Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.5 Secure authentication mostly match
removes

A.8.5 items (k) and (l) directly mandate session termination after inactivity and connection duration restrictions, which are the primary mechanisms for session expiration and address the core of CWE-613; applying the clause to a system that lacked these removes the timeout-based weakness, but the CWE has been expanded to include logout invalidation and session fixation variations that A.8.5 does not reach, and non-configurable third-party products (the majority of observed CVE instances) cannot be remediated by this clause alone.

A.8.9 Configuration management partial match
removes

A.8.9's configuration templates can specify session timeout values (e.g., web server, application server session-timeout settings) and enforce them on operational systems, removing configuration-level instances of CWE-613 such as the demonstrative web.xml `<session-timeout>-1</session-timeout>` case. However, many CWE-613 instances are code-level defects — SDKs that never set token expiration, custom session handlers without expiration logic, or improper logout invalidation — which configuration management cannot rewrite, leaving a nameable remainder of the weakness class untouched.

References