{"metadata": {"vulnerability": "CVE-2026-89076", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-10T18:47:56.872Z", "date_only": false, "value": "2026-09-10T18:47:56.872Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-89076", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89076", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89076", "record": "FKIE_CVE-2026-89076", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T15:00:00Z", "date_only": false, "value": "2026-10-14T15:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / ProgressSoftware", "record": "CVE-2026-89076", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T15:15:23.727Z", "date_only": false, "value": "2026-10-14T15:15:23.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89076", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T15:15:23.727Z", "date_only": false, "value": "2026-10-14T15:15:23.727Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ProgressSoftware", "record": "CVE-2026-89076", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T16:17:55Z", "date_only": false, "value": "2026-10-14T16:17:55Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XCW4-CH93-WCPR", "record": "GHSA-XCW4-CH93-WCPR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T16:17:55.967Z", "date_only": false, "value": "2026-10-14T16:17:55.967", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89076", "record": "FKIE_CVE-2026-89076", "field": "published"}, {"timestamp": "2026-10-14T18:32:19Z", "date_only": false, "value": "2026-10-14T18:32:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XCW4-CH93-WCPR", "record": "GHSA-XCW4-CH93-WCPR", "field": "published"}, {"timestamp": "2026-10-14T18:32:19Z", "date_only": false, "value": "2026-10-14T18:32:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XCW4-CH93-WCPR", "record": "GHSA-XCW4-CH93-WCPR", "field": "modified"}, {"timestamp": "2026-10-14T20:44:47.112Z", "date_only": false, "value": "2026-10-14T20:44:47.112435Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441212299730681", "record": "CVE-2026-89076", "field": "creation_timestamp", "uuid": "0f506f18-9f63-488e-b4ca-02f7813ab899", "content": "CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89076https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026#progress #Progress #MOVEitTransfer#CVE_2026_89076#bot", "url": "https://infosec.exchange/users/cve/statuses/117441212299730681"}, {"timestamp": "2026-10-15T03:57:15.737Z", "date_only": false, "value": "2026-10-15T03:57:15.737Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-89076", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T03:57:15.737Z", "date_only": false, "value": "2026-10-15T03:57:15.737Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89076", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T13:12:15.872Z", "date_only": false, "value": "2026-10-15T13:12:15.872791Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117445095174709223", "record": "CVE-2026-89076", "field": "creation_timestamp", "uuid": "cc3b4ede-c510-44af-9f57-83ff33eebe78", "content": "I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.\nhttps://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026\n\nCWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8\nCWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8   \nCWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1  \nCWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0\nCWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5\nCWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5 \nCWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5\n\nCWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5\nCWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5\nCWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5\nCWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3\nCWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2", "url": "https://infosec.exchange/users/cR0w/statuses/117445095174709223"}, {"timestamp": "2026-10-15T16:08:54.067Z", "date_only": false, "value": "2026-10-15T16:08:54.067", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89076", "record": "FKIE_CVE-2026-89076", "field": "lastModified"}]}