CVE-2026-15966
Received Received - Intake

Permissive Cross-Domain Policy in Progress MOVEit Transfer

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Progress Software Corporation

Description
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-15966

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
progress moveit_transfer From 2026.0.0 (inc) to 2026.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a permissive cross-domain security policy in Progress MOVEit Transfer that allows untrusted domains to interact with the system. It affects versions before 2025.1.5 and from 2026.0.0 to 2026.0.3.

Impact Analysis

An attacker could exploit this to access sensitive data, execute unauthorized actions, or disrupt services by leveraging the weak cross-domain policy. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Update MOVEit Transfer to a patched version: before 2025.1.5 or from 2026.0.0 before 2026.0.3.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart