Skip to content
OpenAdvisories
High · 7.5 CVE-2026-15967 EUVD-2026-48420GHSA-qpgc-j6gh-m63q

MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Published Jul 23, 2026 · Updated Jul 25, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: MOVEit Transfer

Description

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Affected products

VendorProductAffectedFixed
Progress MOVEit Transfer < 2025.1.5, 2026.0.0 – < 2026.0.3 2025.1.5

Advisories 1

References