CVE-2026-15966 is a permissive cross domain security policy in Progress MOVEit Transfer, rated 7.5 (high). It affects versions before 2025.1.5 and 2026.0.0 up to but not including 2026.0.3. Upgrade to 2025.1.5 or 2026.0.3 or later, and review which origins your deployment trusts.
What's affected
- Product: Progress MOVEit Transfer.
- Affected: versions before 2025.1.5, and 2026.0.0 up to but not including 2026.0.3.
- Fixed: 2025.1.5 and 2026.0.3, or later.
- Release notes: Progress's fixed issues page for 2026.0.3, last updated 24 July 2026, lists many security improvements in that service pack. It does not map them to individual CVE numbers, so use Progress's advisory for the exact scope.
- Exploited in the wild: the record is not on the CISA Known Exploited Vulnerabilities list.
- Severity: 7.5 with the record's CWE-942 (permissive cross domain policy with untrusted domains).
How to check if you're exposed
Check the version in the MOVEit Transfer administration interface and compare it with the ranges above. If you run more than one environment, check each one, including test and disaster recovery.
Then decide how reachable the product is. MOVEit Transfer is file transfer software, and many deployments publish a web interface to partners or customers. Make a list of which interfaces are public, which are reachable by partners only, and which are internal.
Finally, check for the service pack in the Progress download portal for your license. Read the release notes page for your version line before upgrading.
What to do now
- Record the MOVEit Transfer version in every environment.
- Upgrade to 2025.1.5 or 2026.0.3 or later, following Progress's upgrade guidance.
- Take a backup and test the upgrade on a non production copy first.
- Review who can reach the web interface and restrict it to the networks that need it.
- After the upgrade, confirm the version and review audit logs for unusual sessions.
Why it matters
CWE-942 describes a policy that lets browsers share data or actions across web origins with domains that should not be trusted. Browsers enforce a same origin rule to keep one site from reading another's data. Cross domain policies are the controlled exceptions, and a permissive one lets the wrong sites in.
For file transfer software, the risk is that a page on an untrusted site could act against a user's session in the application, depending on what the policy allows. The record does not spell out the details, and Progress's public notes do not either, so keep any internal description to what is known: the policy was too permissive, and the service packs fix it.
The record scores it as network reachable and needing no privileges. Even so, whether you are exposed depends on how the product is deployed. Check the version, apply the fix, and keep the interface off networks that do not need it.
Quick check
Is this the same as CVE-2026-15967?
No. They affect the same versions and have the same fixed releases, but this one is about cross domain policy and the other is about session expiration.
Where do I find the fix?
In the MOVEit Transfer service packs 2025.1.5 and 2026.0.3, available from Progress.
Sources
Last reviewed: 19 October 2026.
