AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-11903

Progress Software MOVEit Transfer: cross-site scripting

Progress Software

CVE-2026-11903 · Published Jul 8, 2026 · updated Jul 10, 2026

High8.0
Fix: upgrade to 2026.0.1 or later (3 fixed versions below)
Progress Software advisory

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

Affected versions

PackageAffectedFixed in
MOVEit Transfer
Product
>= 2026.0.0, < 2026.0.12026.0.1
>= 2025.1.0, < 2025.1.42025.1.4
>= 2025.0.0, < 2025.0.82025.0.8
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More Progress Software advisories

All Progress Software
Low 3.5Jul 8Path equivalence: vulnerability in Progress MOVEit TransferCVE-2026-8801fixed in 2025.1.4 +1Medium 6.4Jul 8Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-8649fixed in 2025.1.3 +1Medium 4.5Jul 8Progress Software MOVEit Transfer: path traversalCVE-2026-8650fixed in 2025.1.3 +1Low 3.7Jul 8Progress Software MOVEit Transfer: authentication bypassCVE-2026-8651fixed in 2025.1.3 +1Low 2.7Jul 8Progress Software MOVEit Transfer: improper authorizationCVE-2026-8800fixed in 2025.1.3 +1High 7.2Jul 8Improper Neutralization of Special Elements in Data Query Logic vulnerability...CVE-2026-10698fixed in 2025.0.8 +2