CVE-2026-15968

Progress MOVEit Transfer versions prior to 2025.1.5 and between 2026.0.0 and 2026.0.3 are vulnerable to a cross-site scripting (XSS) flaw due to improper input neutralization during web page generation. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions or data exposure. Organizations using affected versions should prioritize remediation to mitigate the risk of exploitation.