MOVEit Transfer CVE-2026-15968

Exploitation requires an authenticated low-privilege account on the MOVEit Transfer web application (PR:L) and a victim user who must view or interact with the attacker-injected content (UI:R). The CVSS also marks high attack complexity (AC:H), implying non-trivial conditions such as specific input handling or timing to land the payload. Limiting factors: the attacker cannot succeed without valid credentials, cannot trigger impact without a second user opening the malicious content, and only reaches installations running versions before 2025.1.5 or 2026.0.0-2026.0.2; patched builds (2025.1.5 / 2026.0.3) are not exploitable.

The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, 7.1 High) describes network reach but tempers real-world exploitability with high attack complexity (AC:H), a requirement for low-privilege authentication (PR:L), and mandatory victim interaction (UI:R). No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation. The C:H/I:H/A:H impact rating is aggressive for a scope-unchanged XSS and likely reflects worst-case session/account compromise of a privileged operator rather than direct system compromise - treat the impact figures as vendor-assigned rather than independently observable. Net assessment: a real but conditional issue that warrants prompt patching given MOVEit's history of being targeted, yet not an emergency-grade unauthenticated RCE. Missing signals: EPSS and any independent confirmation of exploit availability are absent from the input.

An attacker who holds or phishes a low-privilege MOVEit Transfer account injects a malicious script payload into a field that is later rendered in the web UI (for example a filename, message, or profile field). When a higher-privileged operator or another user views that content, the script runs in their browser, allowing session token theft or actions performed as the victim. No public POC was provided, and the high attack complexity plus required user interaction make this a targeted rather than mass-exploitable technique.