Loading vulnerability…
Permissive Cross-Domain Security Policy in Progress MOVEit Transfer
CVE-2026-15966 is a permissive cross-domain security policy vulnerability involving untrusted domains in Progress MOVEit Transfer. It affects versions earlier than 2025.1.5 and versions from 2026.0.0 through releases before 2026.0.3. The policy permits unauthorized cross-domain interactions, allowing a remote attacker to bypass security restrictions and interact with the application without authorization. Exploitation requires user interaction but no attacker privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass cross-domain security restrictions and permit unauthorized interaction with the application. Depending on deployment context, this could expose sensitive data or enable unintended access. The vulnerability has a reported CVSS v3.1 score of 7.5.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting access to the MOVEit Transfer web interface to only trusted users and networks, reviewing and tightening any cross-origin or cross-domain trust relationships, and monitoring for unexpected cross-domain application interactions. These measures are temporary and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade MOVEit Transfer to version 2025.1.5 or later in the 2025.1 branch, or version 2026.0.3 or later in the 2026.0 branch. Deploy the applicable security update promptly after testing.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.