Vulnerabilities

TI-2026-13370 CVE-2026-15968 · GHSA-hq56-w6jm-c6vp

Stored XSS vulnerability in MOVEit Transfer

LOW 33

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00332 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-79

TI-2026-13369 CVE-2026-15967 · GHSA-qpgc-j6gh-m63q

MEDIUM 43

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00373 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-613

TI-2026-13368 CVE-2026-15966 · GHSA-9rcg-65vx-h53x

MEDIUM 43

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00373 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-942

TI-2026-09196 CVE-2026-10697 · GHSA-55q6-5qrm-8ccf

MEDIUM 44

Improper Authentication vulnerability in Progress MOVEit Transfer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00596 Published 2026-07-23 Fixed in 2025.1.5, 2026.0.3 CWE-287