# CVE-2026-11903: Progress MOVEit Transfer XSS in Ad Hoc module

Source: https://junglewise.ai/threats/cve-2026-11903-progress-moveit-transfer-xss-in-ad-hoc-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-11903 · Severity: high · CVSS 8 · Published 2026-07-08

Progress MOVEit Transfer is a managed file transfer solution used by organizations to securely share sensitive data. A security vulnerability in its Ad Hoc module could allow an attacker to execute malicious scripts in a user's browser. If exploited, this could lead to unauthorized access to user sessions, sensitive file data, or the compromise of the application's integrity.

Technologies: [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-11903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11903 being exploited in the wild.

**How severe is CVE-2026-11903?** High severity, with a CVSS score of 8, published 8 July 2026.

**Which products and versions are affected?** Progress MOVEit Transfer 2026.0.0 before 2026.0.1, 2025.1.0 before 2025.1.4, 2025.0.0 before 2025.0.8.

**Is there a fix for CVE-2026-11903?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11903 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11903?** Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Ad Hoc module of Progress MOVEit Transfer due to improper neutralization of user-supplied input during web page generation. An authenticated attacker with low privileges can inject malicious scripts that are executed when a victim views affected pages within the application. This vulnerability (CWE-79) requires user interaction but can result in high impacts to confidentiality, integrity, and availability by allowing session hijacking or unauthorized actions. The issue is addressed in versions 2026.0.1, 2025.1.4, and 2025.0.8.

## Affected products

- Progress MOVEit Transfer 2026.0.0 before 2026.0.1, 2025.1.0 before 2025.1.4, 2025.0.0 before 2025.0.8

## Timeline

- 2026-07-08: advisory: NVD publication date
- 2026-06: disclosed: Vendor bulletin month

## References

- [https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin-June-2026)

## Related threats

- [Progress MOVEit Transfer SFTP authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-89077-incorrect-implementation-of-authentication-algorithm)
- [Progress MOVEit Transfer SQL injection in Custom Reports](https://junglewise.ai/threats/cve-2026-89076-improper-neutralization-of-special-elements-used-in-an-sql)
- [Progress MOVEit Transfer insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-89075-insecure-storage-of-sensitive-information-vulnerability-in)
- [Progress MOVEit Transfer unicode encoding handling vulnerability](https://junglewise.ai/threats/cve-2026-89074-improper-handling-of-unicode-encoding-vulnerability-in-progress)
- [Progress MOVEit Transfer insufficient session expiration](https://junglewise.ai/threats/cve-2026-89073-insufficient-session-expiration-vulnerability-in-progress-moveit)