EUVD-2026-48419
GHSA-9rcg-65vx-h53x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CORS abuse is browser-mediated so UI:R; attacker's origin is unauthenticated (PR:N) but leverages victim session; impact is mainly confidentiality (C:H), minor integrity (I:L), no availability effect.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
AnalysisAI
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the MOVEit Transfer web interface to be reachable by the victim's browser (typically internet-facing) and running an affected version (before 2025.1.5 or 2026.0.0-2026.0.2), and it hinges on the permissive cross-domain policy trusting an attacker-controlled origin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be reconciled before prioritizing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page and lures a user who is currently authenticated to an internet-facing MOVEit Transfer portal into visiting it. Because MOVEit trusts the attacker's origin in its CORS policy, script on that page issues credentialed cross-origin requests and reads the responses, exfiltrating file listings or sensitive transfer data from the victim's session. … |
| Remediation | Apply the vendor-released patch: upgrade to MOVEit Transfer 2025.1.5 (for the pre-2025.1.5 branch) or 2026.0.3 (for the 2026.0.x branch), as documented in the Progress 2026.0.3 fixed-issues release notes (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Progress MOVEit Transfer installations and identify all systems running versions before 2025.1.5 (2025.x branch) or before 2026.0.3 (2026.x branch). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Same-origin policy bypass in Mozilla Firefox's DOM: Networking component allows a malicious web page to read cross-origi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today