Progress Patches MOVEit Transfer Flaws Linked to Session Hijacking and Unauthorized Access
Vulnerability Disclosure · 3 sources · Updated 4d ago · First seen Jul 26, 2026
Progress Software released security updates for MOVEit Transfer addressing four vulnerabilities: CVE-2026-10697, CVE-2026-15966, CVE-2026-15967, and CVE-2026-15968. An EG-FinCIRT advisory lists potential impacts including session hijacking, cross-site scripting, sensitive-information disclosure, security bypass, and unauthorized account access. Progress also published a fixed-issues page for MOVEit Transfer 2026.0.3, though the supplied material does not establish which fixes that release contains.
EG-FinCIRT assigns CVSS scores of 7.5 to CVE-2026-15966 and 7.1 to CVE-2026-15968, describing both as network-accessible vulnerabilities requiring high attack complexity and user interaction. The advisory does not identify affected or fixed versions or report evidence of active exploitation. Organizations using MOVEit Transfer should confirm version applicability against Progress’s guidance, test the relevant updates, and deploy them promptly.
