Is CVE-2026-15967 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15967 being exploited in the wild.

How severe is CVE-2026-15967?

High severity, with a CVSS score of 7.5, published 23 July 2026.

Which products and versions are affected?

Progress MOVEit Transfer before 2025.1.5, 2026.0.0 before 2026.0.3.

Is there a fix for CVE-2026-15967?

A patch was published on 2026-07-22: Release of MOVEit Transfer 2026.0.3 Service Pack Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15967 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15967?

Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15967: Progress MOVEit Transfer insufficient session expiration in REST API

CVE-2026-15967 · Severity: high · CVSS 7.5 · Published 2026-07-23

Progress MOVEit Transfer, a managed file transfer solution used by organizations to securely share sensitive data, contains a vulnerability in how it manages user sessions. An attacker could potentially exploit this flaw to maintain unauthorized access to an account even after security policies should have terminated the session. This could lead to unauthorized data access, modification of files, or disruption of secure transfer operations.

Technologies: Progress MOVEit Transfer. Vendors: Progress.

Quick answers

Is CVE-2026-15967 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15967 being exploited in the wild.
How severe is CVE-2026-15967?: High severity, with a CVSS score of 7.5, published 23 July 2026.
Which products and versions are affected?: Progress MOVEit Transfer before 2025.1.5, 2026.0.0 before 2026.0.3.
Is there a fix for CVE-2026-15967?: A patch was published on 2026-07-22: Release of MOVEit Transfer 2026.0.3 Service Pack Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15967 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15967?: Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An insufficient session expiration vulnerability (CWE-613) exists in the Progress MOVEit Transfer REST API. The flaw stems from improper token refresh checks that fail to adequately enforce current account access policies during session renewal. A remote attacker could potentially exploit this to extend the life of a session beyond its intended expiration or bypass updated access restrictions. Exploitation requires a high degree of complexity and user interaction (UI:R), but successful exploitation grants full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) within the context of the affected user. The issue is addressed in versions 2025.1.5 and 2026.0.3.

Affected products

Progress MOVEit Transfer before 2025.1.5, 2026.0.0 before 2026.0.3

Timeline

2026-07-22: patched: Release of MOVEit Transfer 2026.0.3 Service Pack
2026-07-23: disclosed: CVE published to NVD

References

https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.