CVE-2026-15967: Insufficient Session Expiration in MOVEit Transfer

CVE-2026-15967 is an insufficient session expiration flaw in Progress MOVEit Transfer, rated 7.5 (high). It affects versions before 2025.1.5 and 2026.0.0 up to but not including 2026.0.3. Upgrade to 2025.1.5 or 2026.0.3 or later, and review your session timeout settings while you are in the admin console.

What's affected

• Product: Progress MOVEit Transfer.
• Affected: versions before 2025.1.5, and 2026.0.0 up to but not including 2026.0.3.
• Fixed: 2025.1.5 and 2026.0.3, or later.
• Release notes: Progress's fixed issues page for 2026.0.3, last updated 24 July 2026, lists many security improvements in that service pack. It does not map them to individual CVE numbers, so use Progress's advisory for the exact scope.
• Exploited in the wild: the record is not on the CISA Known Exploited Vulnerabilities list.
• Severity: 7.5 with the record's CWE-613 (insufficient session expiration).

How to check if you're exposed

Check the version in the MOVEit Transfer administration interface and compare it with the ranges above. If you run more than one environment, check each one, including test and disaster recovery.

Then decide how reachable the product is. MOVEit Transfer is file transfer software, and many deployments publish a web interface to partners or customers. Make a list of which interfaces are public, which are reachable by partners only, and which are internal.

Finally, check for the service pack in the Progress download portal for your license. Read the release notes page for your version line before upgrading.

What to do now

1. Record the MOVEit Transfer version in every environment.
2. Upgrade to 2025.1.5 or 2026.0.3 or later, following Progress's upgrade guidance.
3. Take a backup and test the upgrade on a non production copy first.
4. Review who can reach the web interface and restrict it to the networks that need it.
5. After the upgrade, confirm the version and review audit logs for unusual sessions.
6. Review session timeout settings and shorten them where users do not need long sessions.

Why it matters

CWE-613 covers sessions that stay valid longer than they should: after logout, after a password change, or after a long idle period. A session token works like a temporary key. If it never expires, a token that leaks from a log, a shared computer or a stolen device keeps working.

The record does not say what exactly fails to expire in MOVEit Transfer. Progress's release notes for 2026.0.3 list several session and token handling improvements, but they do not tie them to this CVE, so avoid stating specifics.

Reasonable practice applies regardless: set sensible idle timeouts, invalidate sessions when a password changes, and review active sessions on file transfer systems, which hold data many people care about.

Quick check

Sources

• Progress MOVEit Transfer 2026.0.3 fixed issues

Last reviewed: 19 October 2026.