CVEFinder.io

CVE-2026-15966

⚠️ high
🔍 Scan for this CVE
Summary

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVSS Score
7.5
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-23
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.5% of all 340,405 vulnerabilities in our database.

#107,108
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 24, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-30
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-942

📦 Affected Products 2

Vendor Product Status Affected Versions
progress moveit_transfer Affected
< 2025.1.5
progress moveit_transfer Affected
> 2026.0.0 < 2026.0.3

🔗 References 1

https://docs.progress.com/bundle/moveit-transfer-rel...
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-10697 ⚠️ high 7.5 0.2 Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,... 2026-07-23
CVE-2026-15967 ⚠️ high 7.5 0.2 Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2... 2026-07-23
CVE-2026-15968 ⚠️ high 7.1 0.2 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr... 2026-07-23
CVE-2026-10698 ⚠️ high 7.2 0.4 Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Report... 2026-07-08
CVE-2026-10699 ⚠️ high 7.5 0.3 Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). ... 2026-07-08
CVE-2026-11903 ⚠️ high 8.0 0.2 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Tr... 2026-07-08
These CVEs affect the same products