CVE-2026-89076

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-890778.8Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Tra CVE-2026-890789.9GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 th CVE-2026-890799.8The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. CVE-2026-890807.5The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed CVE-2026-890816.1The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' p CVE-2026-890829.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890839.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890848.8HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890856.6A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer ca CVE-2026-890869.1In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and pro CVE-2026-890877.3The cstruct package before 6.3.0 for OCaml mishandles indexes.CVE-2026-890885.5A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By co