# CVE-2026-15967: Progress MOVEit Transfer insufficient session expiration in REST API

Source: https://junglewise.ai/threats/cve-2026-15967-progress-moveit-transfer-insufficient-session-expiration-in-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-15967 · Severity: high · CVSS 7.5 · Published 2026-07-23

Progress MOVEit Transfer, a managed file transfer solution used by organizations to securely share sensitive data, contains a vulnerability in how it manages user sessions. An attacker could potentially exploit this flaw to maintain unauthorized access to an account even after security policies should have terminated the session. This could lead to unauthorized data access, modification of files, or disruption of secure transfer operations.

Technologies: [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-15967 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15967 being exploited in the wild.

**How severe is CVE-2026-15967?** High severity, with a CVSS score of 7.5, published 23 July 2026.

**Which products and versions are affected?** Progress MOVEit Transfer before 2025.1.5, 2026.0.0 before 2026.0.3.

**Is there a fix for CVE-2026-15967?** A patch was published on 2026-07-22: Release of MOVEit Transfer 2026.0.3 Service Pack Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15967 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15967?** Check whether you run Progress MOVEit Transfer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insufficient session expiration vulnerability (CWE-613) exists in the Progress MOVEit Transfer REST API. The flaw stems from improper token refresh checks that fail to adequately enforce current account access policies during session renewal. A remote attacker could potentially exploit this to extend the life of a session beyond its intended expiration or bypass updated access restrictions. Exploitation requires a high degree of complexity and user interaction (UI:R), but successful exploitation grants full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) within the context of the affected user. The issue is addressed in versions 2025.1.5 and 2026.0.3.

## Affected products

- Progress MOVEit Transfer before 2025.1.5, 2026.0.0 before 2026.0.3

## Timeline

- 2026-07-22: patched: Release of MOVEit Transfer 2026.0.3 Service Pack
- 2026-07-23: disclosed: CVE published to NVD

## References

- [https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html](https://docs.progress.com/bundle/moveit-transfer-release-notes-2026/page/Fixed-Issues-in-2026.0.3.html)

## Related threats

- [Progress MOVEit Transfer SFTP authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-89077-incorrect-implementation-of-authentication-algorithm)
- [Progress MOVEit Transfer SQL injection in Custom Reports](https://junglewise.ai/threats/cve-2026-89076-improper-neutralization-of-special-elements-used-in-an-sql)
- [Progress MOVEit Transfer insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-89075-insecure-storage-of-sensitive-information-vulnerability-in)
- [Progress MOVEit Transfer unicode encoding handling vulnerability](https://junglewise.ai/threats/cve-2026-89074-improper-handling-of-unicode-encoding-vulnerability-in-progress)
- [Progress MOVEit Transfer insufficient session expiration](https://junglewise.ai/threats/cve-2026-89073-insufficient-session-expiration-vulnerability-in-progress-moveit)