Skip to content
OpenAdvisories
High · 8.0 CVE-2026-89069 EUVD-2026-101149GHSA-gwhj-7mgx-69jf

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Published Oct 14, 2026 · Updated Oct 16, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: MOVEit Transfer

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Affected products

VendorProductAffectedFixed
Progress MOVEit Transfer < 2025.1.6, 2026.0.0 – < 2026.0.4 2025.1.6

Advisories 1

References