The MOVEit Transfer Threat Model Has Not Changed: Reading the 2026 Batch Against 2023

e to manage both. Any vulnerability class that touches that console inherits the platform's history. Three properties define the exposure: It is internet-facing by design, because partners need to reach it. It stores other organisations' data, because file transfer is the product. Its administrative console controls who can reach what, so a compromise of the console affects the integrity of the whole exchange. Progress states these properties in its own product material. They are not editorial framing; they explain why a stored XSS in Ad Hoc (CVE-2026-89069, 8.0) carries more operational weight than the same class of bug in an internal wiki. Reading the twelve records structurally rather than individually gives four families. Identity. CVE-2026-89067, CVE-2026-89068, CVE-2026-89070, CVE-2026-89073, CVE-2026-89074 and CVE-2026-89072 all interrupt proving or maintaining who a party is. This is the largest family, and it is the one whose members sit closest to the console's control plane. Input handling. CVE-2026-89069, CVE-2026-89071 and CVE-2026-89076 place attacker-controlled content into a context that treats it as code, SQL or markup. Machine trust. CVE-2026-89077 concerns an authentication algorithm implementation in SFTP, the protocol through which automated partners actually deliver files. Host posture. CVE-2026-87093 and CVE-2026-89075 are local, and they govern what happens after a foothold rather than whether one can be obtained. Authentication defects in a file transfer platform produce a specific second-order problem. Once a session is established, the platform's own authorisation model decides what the session can reach. That model assumes the session is legitimate. CVE-2026-89067 is the clearest example: an alternate path bypasses the check that establishes legitimacy, so everything downstream inherits a false premise. PR:N means no account is needed at all. And to CVE-2026-89074, whose title describes an email MFA bypass through improper Unicode encoding handling, which is a reminder that second factors implemented in application code are themselves application code. If identity is the largest family and the console is the control plane, then controls placed only on the network edge are insufficient. The relevant controls sit closer to the application: Enforce a second factor that does not depend on the module that is being defended. Segregate administrative identities from partner identities so a partner session cannot reach administrative functions even if authentication succeeds wrongly. Treat the MOVEit database role as a separate privilege boundary, which limits what an injection such as CVE-2026-89076 can reach. Log authentication by path, not just by outcome, so an alternate route that succeeds looks different from the intended one. The batch is twelve records in one release, which indicates a coordinated audit rather than a single discovery. Coordinated disclosures are generally a good sign: they mean defects were found and fixed together rather than leaked one at a time. ZoomEye returned 1,677 assets for app="MOVEit" and 546 for title="MOVEit Transfer". CVE-specific queries for this batch returned 0, which reflects fingerprint coverage rather than the absence of vulnerable hosts. The counts describe product surface; the threat model above explains why that surface matters. CVE.org record for CVE-2026-89069: https://cveawg.mitre.org/api/cve/CVE-2026-89069 CVE.org record for CVE-2026-89074: https://cveawg.mitre.org/api/cve/CVE-2026-89074 Progress MOVEit Transfer Critical Security Bulletin, September 2026: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026 ZoomEye app="MOVEit": https://www.zoomeye.ai/searchResult?q=YXBwPSJNT1ZFaXQi