Cross-Site Scripting in Progress MOVEit Transfer Ad Hoc Module

A low-privileged authenticated attacker can cause script to execute in the browser of a user who accesses attacker-controlled Ad Hoc content. This may enable actions in the victim's MOVEit Transfer session, access to data available to that user, modification of user-accessible content, and compromise of the integrity of rendered application content. The published CVSS v3.1 vector assigns High confidentiality, integrity, and availability impacts.

If immediate patching is not possible, reduce exposure of the Ad Hoc module to untrusted users, restrict access to trusted networks or users where operationally feasible, and monitor for suspicious activity involving rendered user-supplied content in MOVEit Transfer. Because this is a server-side application flaw in page generation, mitigation is limited and patching should be treated as the primary corrective action.

Upgrade Progress MOVEit Transfer to a fixed release: 2026.0.1 or later, 2025.1.4 or later, or 2025.0.8 or later, according to the deployed release train. Test the update in the applicable environment and deploy it promptly.