CVE-2026-89076 and the Reporting Endpoint Problem in File Transfer Platforms

Reporting modules are built to answer questions and accumulate query surface while doing it. CVE-2026-89076, a SQL injection finding in the MOVEit Transfer Custom Reports module rated 7.2, is a familiar example of what happens when that accumulated surface meets user-supplied parameters.

Why the score is lower and the risk is not

The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileges required is the only component holding the score down, and it is also the reason the finding deserves attention. Accounts with reporting rights can see across the file estate; a query they control reaches the same database that stores transfer metadata, user records and audit entries.

The three controls that actually help

Parameterized queries are the only structural fix, and the vendor ships it in 2025.1.6 and 2026.0.4. Until that build is in place, three compensating measures reduce reach. Separate the reporting database role from the application role so a query cannot read credential tables. Disable free-text parameters on saved reports and replace them with enumerated selections. Restrict who may create or edit report definitions, because a stored report is a reusable query.

Web application firewalls sit at the bottom of that list for a reason. Pattern matching on SQL syntax flags legitimate filters and misses encoded variants, so it buys a delay rather than closing the path. If the WAF is the only control in place, the reporting endpoint is effectively unpatched until the upgrade lands.

Affected versions

MOVEit Transfer before 2025.1.6 and releases from 2026.0.0 before 2026.0.4 carry the defect. Fixed builds are 2025.1.6 and 2026.0.4. The same release addresses an LDAP injection finding at 7.5, which shares the escaping failure but reaches the directory instead of the database.

Detection notes

Log the full parameter set for report execution, subject to your data-handling rules, and alert when a parameter contains comment sequences, union keywords or stacked statement separators. Correlate a blocked parameter with a subsequent database error in the application log; the pair is a stronger signal than either event alone.

Exposure context

ZoomEye returns 760,697 assets matching app="MOVEit Transfer" and 545 matching title="MOVEit Transfer". The figures describe fingerprint matches rather than confirmed vulnerable installations, and both queries can be re-run at https://www.zoomeye.ai/searchResult?q=YXBwPSJNT1ZFaXQgVHJhbnNmZXIi.