What is the CVSS score of CVE-2026-11903?

CVE-2026-11903 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of MOVEit Transfer are affected by CVE-2026-11903?

Progress MOVEit Transfer has an authenticated vulnerability in its Ad Hoc Transfer module that permits low-privilege users to inject malicious scripts executed in other users' sessions, enabling…. A patch is available.

How to fix or mitigate CVE-2026-11903?

Within 24 hours: Inventory all MOVEit Transfer deployments and identify systems running versions 2026.0.0, 2025.1.0-2025.1.3, or 2025.0.0-2025.0.7. Within 7 days: Upgrade affected systems to 2026.0.1, 2025.1.4, or 2025.0.8 (or later). Within 30 days: Verify patch deployment across all instances, restrict Ad Hoc Transfer module access to users requiring the functionality, enable detailed audit logging on the module, and review monitoring for exploitation patterns.

MOVEit Transfer CVE-2026-11903

EUVD-2026-42280 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 security@progress.com

GHSA-j526-4hhw-j4mr

XSS Moveit Transfer Progress

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (progress) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

7.6 HIGH

Authenticated (PR:L) XSS needing victim interaction (UI:R); script crosses into the victim's context (S:C) enabling session/data theft (C:H), limited integrity (I:L), no direct availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (progress).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 14:07 NVD

HIGH MEDIUM

CVSS changed

Jul 10, 2026 - 14:07 NVD

8.0 (HIGH) 5.4 (MEDIUM)

Patch available

Jul 08, 2026 - 16:01 EUVD

Analysis Generated

Jul 08, 2026 - 15:34 vuln.today

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

AnalysisAI

Stored/reflected cross-site scripting in the Ad Hoc Transfer module of Progress MOVEit Transfer lets an authenticated low-privilege user inject script that executes in another user's browser session, per the CVSS PR:L/UI:R vector. Affected builds are 2026.0.0 before 2026.0.1, 2025.1.0 before 2025.1.4, and 2025.0.0 before 2025.0.8. No public exploit identified at time of analysis, though MOVEit Transfer's history as a mass-exploitation target (prior GoAnywhere/MOVEit campaigns) makes prompt patching prudent.

Technical ContextAI

MOVEit Transfer is an enterprise managed-file-transfer (MFT) web application; the Ad Hoc Transfer module provides browser-based, on-demand file/message sending between users and external recipients. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input rendered in the Ad Hoc module's web pages is not properly encoded, so attacker-supplied HTML/JavaScript is interpreted by the victim's browser rather than displayed as inert text. Because the vulnerable surface is an authenticated web module, injected script runs in the security context of the MOVEit web session, giving access to session tokens, DOM content, and any authenticated actions the victim can perform.

RemediationAI

Upgrade to a fixed release for your branch: MOVEit Transfer 2026.0.1, 2025.1.4, or 2025.0.8 (the first fixed build in each affected line per the version ranges). Consult the Progress advisory (https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026) to confirm the exact patched build and any cumulative prerequisites before deploying. If immediate patching is not possible, reduce exposure by disabling or restricting the Ad Hoc Transfer module (trade-off: users lose ad-hoc send capability), limiting the web interface to trusted networks/VPN to shrink the pool of authenticated actors who can inject payloads, and enforcing a strict Content-Security-Policy at a reverse proxy to blunt script execution (trade-off: may break legitimate module functionality and requires testing). Because exploitation needs an authenticated account, tightening account provisioning and reviewing low-privilege user access is a meaningful compensating control.