External risk intelligence

Progress MOVEit Transfer Permissive Security Policy Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15966

Progress MOVEit Transfer is a managed file transfer solution designed specifically to facilitate data exchange across organizational boundaries. It is typically deployed as a public-facing web portal or gateway to allow external partners and users to upload and download files, making public internet exposure a standard part of its intended operation.

Progress Moveit Transfer

before 2025.1.52026.0.0 to before 2026.0.3

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Progress MOVEit Transfer related to how it handles security policies with untrusted domains. This issue could allow unauthorized access and manipulation of data. The main concern is confirming if our deployment is affected and understanding the potential exposure.

Insecure policy allows untrusted domain access.
Critical vulnerability may impact data integrity.
Confirm relevance and assess system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a Progress MOVEit Transfer system exposed to the internet. The vulnerability resides in the permissive cross-domain security policy, which allows untrusted domains to interact with the system. Successfully triggering this could grant an attacker significant control, potentially leading to unauthorized access, modification, or deletion of data.

System exposed to the internet.
enviados requests to a vulnerable component.
Risk of unauthorized data access and manipulation.

Live Threat

Current exploitation, exposure, and threat context

A permissive cross-domain security policy in Progress MOVEit Transfer could allow an attacker to interact with untrusted domains, potentially impacting the integrity and availability of the service. This could occur when the system is configured to allow such interactions, leading to unauthorized access or manipulation of data handled by the service.

Transfer service and system data.
Via untrusted domain interactions.
Service integrity and availability risks.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Progress MOVEit Transfer, a managed file transfer solution often exposed externally, requires a coordinated response. The platform or application owner is typically responsible for identifying all instances of MOVEit Transfer, assessing their business criticality and exposure, and confirming direct ownership. Coordination with the security and network teams is essential for exposure analysis and remediation planning, which may involve vendor engagement or temporary risk reduction measures until a patch can be applied during a planned maintenance window.

Application owners must confirm MOVEit Transfer instances.
Verify external reachability and business criticality first.
Plan remediation based on confirmed ownership and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MOVEit Transfer?

Progress MOVEit Transfer is a managed file transfer application. Organizations use it as a secure web portal to exchange, upload, and download files with external partners, customers, or internal departments. Because it is designed to move data across organizational boundaries, it often functions as a gateway that facilitates communication between different networks.

What does CWE-942 mean for CVE-2026-15966?

CWE-942 refers to an overly permissive cross-domain security policy. In the context of CVE-2026-15966, this means the software is configured to trust or interact with external domains that it should restrict. By failing to properly vet these requests, the application may inadvertently allow unauthorized third parties to bypass intended security controls and interact with the system.

How is CVE-2026-15966 triggered?

An attacker triggers this vulnerability by sending specially crafted network requests to the MOVEit Transfer system. The bug relies on the system accepting interactions from untrusted domains due to the permissive policy. It is not triggered by standard, authorized file transfers or legitimate internal traffic that adheres to restricted, secure domain policies.

Is my MOVEit Transfer instance at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your instance is public-facing. Because MOVEit Transfer is often deployed as a gateway for external data exchange, internet-exposed systems are the primary targets for these unauthorized cross-domain requests. If your server is strictly internal and has no exposure to the public internet, the attack path is significantly limited.

How do I respond to this vulnerability?

The first step is to identify all MOVEit Transfer instances in your environment and check if your version falls within the affected ranges. Confirm which systems are exposed to the internet, as these require immediate attention. Coordinate with your security and network teams to apply the vendor-provided updates, as upgrading to a secure version is the only way to resolve the underlying policy flaw.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.