Loading vulnerability…
Insufficient Session Expiration in Progress MOVEit Transfer
CVE-2026-15967 is an insufficient session expiration vulnerability in Progress MOVEit Transfer affecting versions before 2025.1.5 and versions from 2026.0.0 before 2026.0.3. Legitimate user sessions may remain valid longer than intended, allowing a remote attacker to gain unauthorized access through an improperly expired session. The vulnerability has a reported CVSS v3.1 score of 7.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Failure to expire sessions correctly can permit unauthorized access to user accounts and continued access beyond the intended session lifetime. The resulting access is associated with the affected user's session; specific accessible data and operations are not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by enforcing shorter session lifetimes where configurable, requiring reauthentication for sensitive actions, terminating active sessions after administrative maintenance windows, and monitoring for anomalous reuse of long-lived sessions. These measures are temporary and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade Progress MOVEit Transfer to version 2025.1.5 or later in the 2025.1 branch, or version 2026.0.3 or later in the 2026.0 branch. Deploy the applicable vendor security update promptly after testing.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.