CVE-2026-15967

Received Received - Intake

Insufficient Session Expiration in MOVEit Transfer

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Progress Software Corporation

Description

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-15967

Affected Vendors & Products

Vendor	Product	Version / Range
progress	moveit_transfer	to 2025.1.5 (exc)
progress	moveit_transfer	From 2026.0.0 (inc) to 2026.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This is an insufficient session expiration vulnerability in Progress MOVEit Transfer. It allows sessions to remain active longer than intended, potentially enabling unauthorized access to sensitive data even after a user logs out or the session should have expired.

Impact Analysis

An attacker could exploit this to maintain access to your MOVEit Transfer account or data even after you log out. This could lead to data theft, unauthorized file transfers, or other malicious activities depending on the permissions of the compromised account.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and privacy such as GDPR and HIPAA. It may lead to unauthorized access to personal or sensitive data, resulting in potential legal penalties, fines, or reputational damage due to non-compliance with data retention and security policies.

Mitigation Strategies

Upgrade MOVEit Transfer to version 2025.1.5 or later if using versions before 2025.1.5. If using versions 2026.0.0 to 2026.0.2, upgrade to 2026.0.3 or later.

Hi! I’m here to help you understand CVE-2026-15967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70