CVEFinder.io

CVE-2026-11903

⚠️ high
🔍 Scan for this CVE
Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

CVSS Score
8.0
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-08
First Seen: 2026-07-09
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 77.2% of all 340,405 vulnerabilities in our database.

#77,677
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 8, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-10
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-79

📦 Affected Products 4

Vendor Product Status Affected Versions
progress moveit_transfer Affected
< 2024.1.8
progress moveit_transfer Affected
> 2025.0.0 < 2025.0.8
progress moveit_transfer Affected
> 2025.1.0 < 2025.1.4
progress moveit_transfer Affected
v2026.0.0

🔗 References 1

https://community.progress.com/s/article/MOVEit-Tran...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-10697 ⚠️ high 7.5 0.2 Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,... 2026-07-23
CVE-2026-15966 ⚠️ high 7.5 0.2 Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue af... 2026-07-23
CVE-2026-15967 ⚠️ high 7.5 0.2 Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2... 2026-07-23
CVE-2026-15968 ⚠️ high 7.1 0.2 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr... 2026-07-23
CVE-2026-10698 ⚠️ high 7.2 0.4 Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report... 2026-07-08
CVE-2026-10699 ⚠️ high 7.5 0.3 Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). ... 2026-07-08
These CVEs affect the same products