CVE-2026-87093

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-870959.1Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber ICVE-2026-870963.3Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber ICVE-2026-871058.8Tanium addressed a SQL injection vulnerability in Threat Response.CVE-2026-871066.5Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaCVE-2026-871075.4Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token tCVE-2026-871084.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different projCVE-2026-871096.5An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing enCVE-2026-87119.8NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (forCVE-2026-871105.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly workCVE-2026-871117.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to StCVE-2026-871136.3Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-871147.1A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container imag
CVE-2026-87093: High severity, CVSS 8.8 | Vulnix