Vulnerabilities

TI-2026-10270 CVE-2026-11903 · GHSA-j526-4hhw-j4mr

Stored XSS in MOVEit Transfer Ad Hoc module

LOW 37

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00408 Published 2026-07-08 Fixed in 2026.0.1, 2025.1.4 +1 CWE-79

TI-2026-09198 CVE-2026-10699 · GHSA-r246-g2w6-6gr3

LOW 39

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00494 Published 2026-07-08 Fixed in 2025.0.8, 2025.1.4 +1 CWE-401

TI-2026-09197 CVE-2026-10698 · GHSA-8rpj-q4gm-gm6v

LOW 35

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00644 Published 2026-07-08 Fixed in 2025.0.8, 2025.1.4 +1 CWE-943