AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-15966

Permissive cross-domain security policy with untrusted domains vulnerability in...

Progress Software

CVE-2026-15966 · Published Jul 23, 2026 · updated Jul 30, 2026

High7.5
Fix: upgrade to 2025.1.5 or later (2 fixed versions below)
Progress Software advisory

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Affected versions

PackageAffectedFixed in
MOVEit Transfer
Product
< 2025.1.52025.1.5
>= 2026.0.0, < 2026.0.32026.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-942

More Progress Software advisories

All Progress Software
High 7.1Jul 23Progress Software MOVEit Transfer: cross-site scriptingCVE-2026-15968fixed in 2025.1.5 +1High 7.5Jul 23Progress Software MOVEit Transfer: insufficient session expirationCVE-2026-15967fixed in 2025.1.5 +1High 7.5Jul 23Progress Software MOVEit Transfer: improper authenticationCVE-2026-10697fixed in 2025.1.5 +1Medium 5.3Jul 22Progress Software Telerik UI for ASP.NET AJAX: denial of serviceCVE-2026-14865fixed in 2026.2.708Medium 6.5Jul 22Progress Software Telerik UI for ASP.NET AJAX: hard-coded keyCVE-2026-14932fixed in 2026.2.708High 8.1Jul 22Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13185fixed in 2026.2.708