What is the CVSS score of EUVD-2026-48419?

EUVD-2026-48419 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MOVEit Transfer are affected by EUVD-2026-48419?

Progress MOVEit Transfer contains a critical cross-origin data leakage vulnerability (CVE-2026-15966) that allows attackers to steal sensitive data from authenticated users' sessions by exploiting an…. A patch is available.

How to fix or mitigate EUVD-2026-48419?

Within 24 hours, conduct a complete inventory of Progress MOVEit Transfer installations and identify all systems running versions before 2025.1.5 (2025.x branch) or before 2026.0.3 (2026.x branch). Within 7 days, apply vendor-released patches to upgrade all instances to MOVEit Transfer 2025.1.5 or 2026.0.3 or later, and confirm patch deployment across your entire environment. Within 30 days, execute post-patch validation testing and implement enhanced monitoring of cross-origin request patterns and session access logs within MOVEit Transfer.

MOVEit Transfer EUVD-2026-48419

| CVE-2026-15966 CRITICAL

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-23 ProgressSoftware

GHSA-9rcg-65vx-h53x

Information Disclosure Cors Misconfiguration Moveit Transfer Progress

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ProgressSoftware) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

CORS abuse is browser-mediated so UI:R; attacker's origin is unauthenticated (PR:N) but leverages victim session; impact is mainly confidentiality (C:H), minor integrity (I:L), no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 16:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 15:52 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 15:52 NVD

HIGH CRITICAL

CVSS changed

Jul 30, 2026 - 15:52 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Patch available

Jul 23, 2026 - 23:03 EUVD

Analysis Generated

Jul 23, 2026 - 20:52 vuln.today

CVE Published

Jul 23, 2026 - 19:58 cve.org

HIGH 7.5

DescriptionNVD

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

AnalysisAI

Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).

Technical ContextAI

The affected component is Progress MOVEit Transfer, a widely used managed file transfer (MFT) server for securely exchanging sensitive business files over HTTP/HTTPS. The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the application's CORS configuration reflects or whitelists untrusted origins in Access-Control-Allow-Origin (often combined with Access-Control-Allow-Credentials: true), so a browser will permit cross-origin JavaScript from an attacker-controlled domain to issue credentialed requests to the MOVEit web interface and read the responses. The single CPE in scope is cpe:2.3:a:progress:moveit_transfer, and vendor tags 'Cors Misconfiguration' and 'Information Disclosure' confirm the mechanism is browser-mediated cross-origin data exposure rather than a memory-safety or injection flaw.

RemediationAI

Apply the vendor-released patch: upgrade to MOVEit Transfer 2025.1.5 (for the pre-2025.1.5 branch) or 2026.0.3 (for the 2026.0.x branch), as documented in the Progress 2026.0.3 fixed-issues release notes (https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html). If patching must be delayed, apply compensating controls at the web tier: tighten the CORS policy so Access-Control-Allow-Origin returns only an explicit allowlist of trusted origins (never a reflected/wildcard origin) and disable Access-Control-Allow-Credentials for any wildcard responses - this can break legitimate third-party integrations that rely on cross-origin API calls, so validate integration behavior first. Additionally restrict access to the MOVEit web interface to trusted networks/VPN and consider a reverse proxy or WAF rule to strip or override permissive CORS headers, accepting the trade-off that overly strict rules may block sanctioned browser-based clients. Confirm exact fixed versions against the vendor advisory before deployment.