{"id":"CVE-2026-89073","published":"2026-10-14T16:17:55Z","modified":"2026-10-19T12:16:05Z","title":"Insufficient Session Expiration vulnerability in Progress MOVEit Transfer","vendor":"Progress","product":"MOVEit Transfer","tier":"core","eol":null,"description":{"text":"Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.","provenance":"source","from":"NVD"},"summary":{"text":"Progress MOVEit Transfer contains an insufficient session expiration flaw (CWE: Insufficient Session Expiration), which affects versions before 2025.1.6 and the 2026.0.0 line before 2026.0.4. An attacker with network access can exploit it without authentication or user interaction, as the attack vector indicates no privileges or user action are required, and it can lead to high impact on confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:16Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.004,"percentile":0.34285,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 23, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ada23770d71749da2321a29","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad8d3466c8181f05516bab7","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad78144340f998d3db4d0bc","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad62f761b14c745b837b947","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad4ddb44d734735b605dc2f","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad38c34c49c0273168a0f7d","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad23abd6cb9332fcbb88e3b","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ad0e94086fc75fcda994436","created":"2026-10-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-613","name":"DEPRECATED: Insufficient Session Expiration"}],"references":[{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-101155","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101155","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89073","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.86,"detail":"percentile 0.3428"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}