Loading vulnerability…
Cross-site scripting in Progress MOVEit Transfer
CVE-2026-15968 is a cross-site scripting vulnerability in Progress MOVEit Transfer caused by improper neutralization of input during web page generation. It affects versions before 2025.1.5 and versions from 2026.0.0 up to, but excluding, 2026.0.3. Exploitation is network-accessible, requires low privileges and user interaction, and has high attack complexity. The reported CVSS score is 7.1. The specific vulnerable function and whether the flaw is stored or reflected are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attacker-controlled script to execute in a user's browser in the context of the affected MOVEit Transfer application. Additional impacts specific to this vulnerability are not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to the MOVEit Transfer web interface to trusted users and networks, minimizing the number of high-privilege users who access the application, and monitoring for suspicious activity consistent with script injection or unauthorized actions in user sessions. These measures are temporary and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade Progress MOVEit Transfer to version 2025.1.5 or later in the corresponding release branch, or to version 2026.0.3 or later in the 2026.0 release branch. Deploy the applicable security update promptly after testing.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.