Progress Security Updates – 26 July 2026

The addressed vulnerabilities could allow the attacker to perform session hijacking or cross-site scripting (CSS) attacks, obtain sensitive information, bypass security restrictions, or execute arbitrary scripts and gain unauthorized access to user accounts on the affected system.

Sample of the addressed vulnerabilities:

1. Progress MOVEit Transfer Permissive Cross-Domain Security Policy with Untrusted Domains Vulnerability (CVE-2026-15966):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: Required
• Consequences: Security Bypass

2. Progress MOVEit Transfer Improper Neutralization of Input Vulnerability (CVE-2026-15968):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: Required
• Consequences: Cross-Site Scripting