BugRater
Early access. This site has moved to bugrater.com.

Security releases

Progress

Progress Security Releases - October 2026

progress-2026-10 Oct 1, 2026 Source: Vendor

Progress security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-93693
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

11 lines
All 11 CVEs 11 Additional recognition 0 Unclaimed only
Showing 1–11 of 11
CVE-2026-87093 BR2026-0000-031011 MOVEit Transfer unclaimed
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland https://bugcrowd.com/h/Mace https://x.com/BalboaMace https://www.linkedin.com/in/maciej-nowak-522125237/
CVE-2026-89067 BR2026-0000-031012 MOVEit Transfer unclaimed
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Leo Oliver (ssrfer)
CVE-2026-89068 BR2026-0000-031013 MOVEit Transfer unclaimed
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Leo Oliver (ssrfer)
CVE-2026-89069 BR2026-0000-031014 MOVEit Transfer unclaimed
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 ...
Credited as Matt Grover
CVE-2026-89071 BR2026-0000-031015 MOVEit Transfer unclaimed
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 an...
Credited as bugbunny.ai
CVE-2026-89072 BR2026-0000-031016 MOVEit Transfer unclaimed
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Mateusz Mieczkowski
CVE-2026-89073 BR2026-0000-031017 MOVEit Transfer unclaimed
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Maciej 'mace' Nowak - Cybersecurity Researcher at Robert BOSCH, Poland
https://bugcrowd.com/h/Mace
https://x.com/BalboaMace
https://www.linkedin.com/in/maciej-nowak-522125237/
CVE-2026-89074 BR2026-0000-031018 MOVEit Transfer unclaimed
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as Leo Oliver (ssrfer)
CVE-2026-89075 BR2026-0000-031019 MOVEit Transfer unclaimed
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as bugbunny.ai
CVE-2026-89076 BR2026-0000-031020 MOVEit Transfer unclaimed
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2...
Credited as Ryan Vinton
CVE-2026-89077 BR2026-0000-031021 MOVEit Transfer unclaimed
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Credited as bugbunny.ai