CVE-2026-15966Disclosure(progress / moveit_transfer)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch progress moveit_transfer systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

progress CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html

Weakness type (CWE)

CWE-942

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

moveit_transfer

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-07-24); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

progress

Products

moveit_transfer

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-24	2	Disclosure2
2026-07-30	1	General1
2026-07-31	1	Patch1

Full discourse4 posts

CERT-PY@CERTpy85d
General
⚠️ Vulnerabilidades en productos Progress ❗ CVE-2026-15967 ❗ CVE-2026-15966 ❗ CVE-2026-10697 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-progress-5/ https://t.co/T39j23thcn
Post summary
The tweet lists three CVE identifiers for vulnerabilities in Progress products and provides a link for additional information, but no specific technical, exploitation, or remediation details are included.
00001213
6.7K followersView on X
Autumn Good@autumn_good_3584d
Patch
CVE-2026-10697 CVE-2026-15966 CVE-2026-15967 CVE-2026-15968 MOVEit Transfer 2026 Release Notes Fixed Issues in 2026.0.3 https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html
Post summary
The MOVEit Transfer 2026.0.3 release notes announce that CVE‑2026‑10697, CVE‑2026‑15966, CVE‑2026‑15967, and CVE‑2026‑15968 have been fixed, with no PoC, exploitation, or technical detail provided beyond the CVE identifiers.
00000447
7.0K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-15966 Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2… https://www.cve.org/CVERecord?id=CVE-2026-15966 ----- Traducción: CVE-2026-15966 Pol… http://infoflow.cloud`
Post summary
The post announces CVE-2026-15966, describing a permissive cross-domain policy flaw in Progress MOVEit Transfer, but offers no PoC, exploit code, patch, or evidence of active exploitation.
0000040
94 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-15966 Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2… https://www.cve.org/CVERecord?id=CVE-2026-15966
Post summary
The post identifies CVE-2026-15966 as a permissive cross‑domain security policy issue in Progress MOVEit Transfer, referencing the official CVE record but providing no exploitation, patch, or PoC details.
000001.4K
57.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	progress	moveit_transfer	-	-	-

Explore more

Back to dashboard progress CVEs moveit_transfer vulnerabilities

What researchers are saying

CVE-2026-15966

CERT-PY@CERTpyGeneral

The tweet lists three CVE identifiers for vulnerabilities in Progress products and provides a link for additional information, but no specific technical, exploitation, or remediation details are included.

Autumn Good@autumn_good_35Patch

The MOVEit Transfer 2026.0.3 release notes announce that CVE‑2026‑10697, CVE‑2026‑15966, CVE‑2026‑15967, and CVE‑2026‑15968 have been fixed, with no PoC, exploitation, or technical detail provided beyond the CVE identifiers.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-15966, describing a permissive cross-domain policy flaw in Progress MOVEit Transfer, but offers no PoC, exploit code, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

The post identifies CVE-2026-15966 as a permissive cross‑domain security policy issue in Progress MOVEit Transfer, referencing the official CVE record but providing no exploitation, patch, or PoC details.