CVE-2026-15967
published 2026-07-23CVE-2026-15967: Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.20%
10.7th percentile
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | moveit_transfer | < 2025.1.5 | 2025.1.5 |
| progress | moveit_transfer | >= 2026.0.0 < 2026.0.3 | 2026.0.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Progress MOVEit Transfer up to 2025.1.4/2026.0.2 session expiration
vuldb·2026-07-23·CVSS 7.5
CVE-2026-15967 [HIGH] Progress MOVEit Transfer up to 2025.1.4/2026.0.2 session expiration
A vulnerability, which was classified as critical, was found in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. This issue affects some unknown processing. Executing a manipulation can lead to session expiration.
The identification of this vulnerability is CVE-2026-15967. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
ghsa_unreviewed·2026-07-23
CVE-2026-15967 [HIGH] CWE-613 Insufficient session expiration vulnerability in Progress MOVEit Transfer.
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-23
Published