MOVEit Transfer CVE-2026-11903

Exploitation requires an authenticated MOVEit Transfer account with at least low privileges (CVSS PR:L) and the Ad Hoc Transfer module must be in use, since the vulnerable input handling is specific to that module. The attack is not self-contained: a victim must view the attacker-supplied content in the MOVEit web interface (CVSS UI:R), so successful exploitation depends on tricking or waiting for another user - ideally a higher-privileged one - to render the malicious page. Limiting factors are therefore the need for valid credentials, the requirement that the Ad Hoc module be enabled/reachable, and the dependency on victim interaction; these narrow real-world risk well below an unauthenticated, no-interaction flaw.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) rates this High, but several signals warrant scrutiny. Attack vector is network with low complexity, yet it requires both low-privilege authentication (PR:L) and victim interaction (UI:R), so it is not a drive-by unauthenticated flaw. The declared C:H/I:H/A:H triad is aggressive for a typical XSS - high confidentiality (session/data theft) is well-supported, but full high integrity and availability impact via script injection is less obvious and may reflect vendor worst-case assumptions in a file-transfer context; verify with the Progress advisory. No EPSS score, KEV entry, POC, or SSVC data was provided, so real-world exploitation probability cannot be quantified from the input. Net: a credible, patch-worthy issue - the authentication and user-interaction requirements lower its urgency relative to the unauthenticated MOVEit RCE flaws of prior years, but MOVEit's high-value MFT deployment base keeps it a priority.

An attacker with a low-privilege MOVEit account crafts an Ad Hoc Transfer message or field containing a malicious script payload and sends it to a targeted user or administrator. When the victim opens the message in the MOVEit web UI (UI:R), the script executes in their session, allowing theft of the session token or actions performed as the victim. No public exploit code was identified at time of analysis.