What is the CVSS score of CVE-2026-15968?

CVE-2026-15968 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of MOVEit Transfer are affected by CVE-2026-15968?

Progress MOVEit Transfer exposes organizations to session hijacking and file transfer manipulation through cross-site scripting vulnerability CVE-2026-15968, which requires authenticated access and…. A patch is available.

How to fix or mitigate CVE-2026-15968?

Within 24 hours: Identify all Progress MOVEit Transfer deployments and document current versions; flag systems running versions before 2025.1.5 (or 2026.0.3 for 2026-branch instances); contact Progress support immediately for interim compensating control recommendations. Within 7 days: Implement network access restrictions limiting MOVEit platform connectivity to essential users and networks; enable comprehensive audit logging of all file transfers and user sessions. Within 30 days: Deploy vendor patch immediately upon release by Progress; audit all transfer and user activity logs from the vulnerability discovery date for signs of exploitation.

MOVEit Transfer CVE-2026-15968

EUVD-2026-48421 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 ProgressSoftware

GHSA-hq56-w6jm-c6vp

XSS Moveit Transfer Progress

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (ProgressSoftware) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Authenticated injector (PR:L) and required victim interaction (UI:R) with non-trivial conditions (AC:H); XSS crosses into the victim's browser context so S:C with limited C/I and no availability impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 30, 2026 - 15:52 NVD

HIGH MEDIUM

CVSS changed

Jul 30, 2026 - 15:52 NVD

7.1 (HIGH) 5.4 (MEDIUM)

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 20:50 vuln.today

CVE Published

Jul 23, 2026 - 20:01 cve.org

HIGH 7.1

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

AnalysisAI

Stored/reflected cross-site scripting in Progress MOVEit Transfer (versions before 2025.1.5, and the 2026 branch from 2026.0.0 before 2026.0.3) allows an authenticated low-privilege user to inject script that executes in another user's browser session when the victim views the crafted content. Because MOVEit Transfer is an internet-facing managed file transfer platform, successful exploitation can hijack privileged sessions and manipulate transferred data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

MOVEit Transfer is Progress Software's managed file-transfer (MFT) web application used to move sensitive files securely between organizations. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is reflected or stored into an HTML response without adequate output encoding, so a browser interprets it as executable script. The affected component is the MOVEit Transfer web interface; per the CPE cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:* the vulnerable product is the MOVEit Transfer application across affected release lines. In an MFT context XSS is significant because the web UI handles authentication tokens, file metadata, and administrative functions, so injected script runs with the trust of the logged-in operator or end user.

RemediationAI

Vendor-released patch: upgrade MOVEit Transfer to 2025.1.5 (for pre-2026 branches) or to 2026.0.3 (for the 2026.0.x branch), as documented at https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html. If patching must be delayed, reduce exposure by restricting access to the MOVEit Transfer web interface to trusted networks or a VPN, limiting and reviewing low-privilege account provisioning (the flaw requires an authenticated PR:L user to inject), and enforcing a strict Content-Security-Policy plus HttpOnly session cookies to blunt script execution and cookie theft - noting that CSP tuning can break embedded UI features and should be tested. Educate operators not to open unexpected links or content, since exploitation requires victim interaction. Do not rely on these controls as a permanent substitute for the fixed version.