What is the CVSS score of CVE-2026-15967?

CVE-2026-15967 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MOVEit Transfer are affected by CVE-2026-15967?

Progress MOVEit Transfer versions before 2025.1.5 and 2026.0.0-2026.0.2 fail to properly expire user sessions, allowing attackers with access to an active session token to maintain unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-15967?

Immediately audit your Progress MOVEit Transfer infrastructure to identify all instances and their version numbers-specifically those running builds before 2025.1.5 or versions 2026.0.0 through 2026.0.2, which are vulnerable to session hijacking. Within 7 days, deploy vendor-released patches by upgrading to Progress MOVEit Transfer version 2025.1.5 or later for the 2025 release track, or version 2026.0.3 or later for the 2026 release track, depending on your current deployment. Within 30 days, confirm patch deployment across your entire MOVEit infrastructure, review authentication logs for anomalous session activity or token reuse patterns that may indicate prior exploitation, and conduct functional testing to verify that session expiration is being enforced correctly.

MOVEit Transfer CVE-2026-15967

EUVD-2026-48420 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-07-23 ProgressSoftware

GHSA-qpgc-j6gh-m63q

Information Disclosure Moveit Transfer Progress

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ProgressSoftware) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and low-complexity to replay, but CWE-613 requires the attacker to first obtain a leaked/stale session (modeled as UI:R); session reuse yields data/integrity access, not availability loss, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 15:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Jul 30, 2026 - 15:52 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 20:51 vuln.today

CVE Published

Jul 23, 2026 - 19:59 cve.org

HIGH 7.5

DescriptionNVD

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

AnalysisAI

Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves sessions valid longer than they should be, so an attacker who obtains a still-active session token can access the managed file transfer application without re-authenticating. Progress rates this CVSS 9.8 with total technical impact, though the CWE-613 root cause makes the unauthenticated network vector worth verifying. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).

Technical ContextAI

MOVEit Transfer is Progress Software's managed file transfer (MFT) platform used to move regulated and sensitive business data, exposed over HTTP(S) web and API interfaces. The flaw is classified CWE-613 (Insufficient Session Expiration): the application fails to invalidate or time out authenticated sessions promptly, meaning a session identifier that should be dead remains usable. The single affected CPE is cpe:2.3:a:progress:moveit_transfer, spanning the 0-to-2025.1.5 line and the 2026.0.0-to-2026.0.3 line. Because MFT platforms broker high-value file access, a reusable session directly translates into access to transferred files and administrative or user functions.

RemediationAI

Vendor-released patch: upgrade to MOVEit Transfer 2025.1.5 (for the pre-2025.1.5 line) or 2026.0.3 (for the 2026.0.x line), per Progress's Fixed Issues in 2026.0.3 release notes (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html). Until patched, reduce exposure by restricting the MOVEit web/API interface to trusted networks or behind a VPN so stray session tokens cannot be reused from the internet (trade-off: breaks external partner access), shortening idle/absolute session timeouts and forcing global session invalidation/re-authentication of all active users if the configuration allows it (trade-off: users must log in again), and placing the app behind a WAF/reverse proxy that enforces its own session lifetime and terminates idle connections. Given the CWE-613 nature, also rotate/expire existing sessions and audit for reuse of old tokens after upgrading.