CVE-2026-15966— Improper CORS handling in MOVEit Transfer
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress | MOVEit Transfer | < 2025.1.5 | affected |
2026.0.0< 2026.0.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15966
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper CORS handling in MOVEit Transfer
Source: CVE Program / CVE List V5
Vulnerability Description
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
过度许可的跨域白名单
Source: CVE Program / CVE List V5
Vulnerability Title
Progress MOVEit Transfer 配置错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress MOVEit Transfer是Progress公司的一款文件传输软件。 Progress MOVEit Transfer 2025.1.5之前版本和2026.0.0至2026.0.3之前版本存在配置错误漏洞，该漏洞源于跨域安全策略过于宽松，可能导致攻击者利用不可信域进行攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress | MOVEit Transfer | 0 ~ 2025.1.5 | - |
II. Public POCs for CVE-2026-15966
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15966
请登录查看更多情报信息。
Vendor Pages for CVE-2026-15966 (1)
- 🔗 Fixed Issues in 2026.0.3release-notes
Same Patch Batch · Progress · 2026-07-23 · 4 CVEs total
| CVE-2026-15967 | 7.5 HIGH | MOVEit Transfer refresh-token processing does not enforce updated account restrictions |
| CVE-2026-10697 | 7.5 HIGH | MFA Bypass in MOVEit Transfer |
| CVE-2026-15968 | 7.1 HIGH | Stored XSS vulnerability in MOVEit Transfer |
IV. Related Vulnerabilities
Same product: MOVEit Transfer
- CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer - CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up - CVE-2026-10697
MFA Bypass in MOVEit Transfer - CVE-2026-8801
File Extension Restriction Bypass in MOVEit Transfer - CVE-2026-8800
Cross-Org External Token Metadata accessible to AuditUser ro
Same vendor: Progress
- CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer - CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up - CVE-2026-10697
MFA Bypass in MOVEit Transfer - CVE-2026-15724
Path traversal in Progress ShareFile Storage Zones Controlle - CVE-2026-8801
File Extension Restriction Bypass in MOVEit Transfer
V. Comments for CVE-2026-15966
No comments yet