CVE-2026-15967: MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Published Jul 23, 2026
·
Updated

Insufficient session expiration vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Affected Software

3 affected components
Progress MOVEit Transfer>2026.0.0<2026.0.3, <2025.1.5
Progress MOVEit Transfer<2025.1.5
Progress MOVEit Transfer>=2026.0.0<2026.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Progress MOVEit Transfer to a version that resolves this vulnerability.

    Fixed in 2025.1.5
  2. Upgrade

    Upgrade Progress MOVEit Transfer to a version that resolves this vulnerability.

    Fixed in 2026.0.3

Event History

Jul 23, 2026
CVE Published
via MITRE·07:59 PM
Data Sourced
via MITRE·07:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Jan 13, 58548
Event
via NVD·07:16 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-15967?

The severity of CVE-2026-15967 is high with a CVSS score of 7.5.

2

What impact does CVE-2026-15967 have on Progress MOVEit Transfer?

CVE-2026-15967 allows insufficient enforcement of updated account restrictions during refresh-token processing.

3

How do I fix CVE-2026-15967?

To fix CVE-2026-15967, upgrade Progress MOVEit Transfer to version 2026.0.3 or later.

4

Which versions of Progress MOVEit Transfer are affected by CVE-2026-15967?

CVE-2026-15967 affects all versions of Progress MOVEit Transfer before 2025.1.5 and from 2026.0.0 before 2026.0.3.

5

What types of attacks are possible due to CVE-2026-15967?

CVE-2026-15967 may allow unauthorized access to sensitive information due to insufficient session expiration.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203