CVE Watch19 oct 2026

CVE-2026-89075

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 an

CVSS

7.3

Alto

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 14 oct 2026 · Última mod.: 19 oct 2026 · CWE-922

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-10-152026-10-19

Descripción técnica

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Referencias oficiales

community.progress.comhttps://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-821532.2 BAJ

1.4%

——0Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.6d CVE-2026-50475.7 MED

8.8%

——3A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.6d CVE-2026-84283—

1.1%

——0Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.26d CVE-2026-77875—

7.7%

——2The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.28d CVE-2026-446297.9 ALT

3.8%

——1Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers.41d CVE-2025-593204.6 MED

14.2%

——4CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM.22d