Skip to content
OpenAdvisories
Medium WID-SEC-2026-2512 4 CVEs

Progress Software MOVEit Transfer: Mehrere Schwachstellen

Published Jul 23, 2026 · Updated Jul 23, 2026 · de-DE

Vendor: Progress Software Product: MOVEit Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Progress Software MOVEit Transfer ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Progress MOVEit ist eine sichere Managed File Transfer (MFT)-Software, die Transparenz und Kontrolle über die Dateiübertragungsaktivitäten bietet.

Vulnerabilities 4

  • High 7.5
    CVE-2026-10697

    MFA Bypass in MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress Software MOVEit Transfer
  • High 7.5
    CVE-2026-15966

    Improper CORS handling in MOVEit Transfer

    Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress Software MOVEit Transfer
  • High 7.5
    CVE-2026-15967

    MOVEit Transfer refresh-token processing does not enforce updated account restrictions

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress Software MOVEit Transfer
  • High 7.1
    CVE-2026-15968

    Stored XSS vulnerability in MOVEit Transfer

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

    Progress Software MOVEit Transfer

Revision history

  1. #1

    Initiale Fassung

References