CVE-2026-11903
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An XSS vulnerability was found in the Ad Hoc module of Progress MOVEit Transfer due to improper input neutralization during page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.
Risk Assessment
The risk includes session hijacking, account takeover, theft of sensitive data transferred via MOVEit Transfer, and potential propagation of the attack to other system users.
Recommendation
Immediately update MOVEit Transfer to version 2026.0.1, 2025.1.4, or 2025.0.8 depending on your branch. Before updating, restrict access to the Ad Hoc module to trusted users only.
Other vulnerabilities in Progress MOVEit Transfer
See all- CVE-2026-8801Low
Path equivalence vulnerability in the File Upload module of Progress MOVEit Transfer allows potential security bypass. Affects versions before 2025.0.8 and from 2025.1.0 before 2025.1.4.
- CVE-2026-8800Low
Incorrect authorization vulnerability in the Audit User module of Progress MOVEit Transfer. The flaw allows unauthorized access to user audit functions.
- CVE-2026-8650Medium
Relative path traversal vulnerability in the Admin Settings module of Progress MOVEit Transfer. Allows an attacker to access files outside the intended directory.
- CVE-2026-8649Medium
An improper neutralization of special elements in data query logic vulnerability exists in Progress MOVEit Transfer (Custom Reports modules). Affected versions are before 2025.0.7 and from 2025.1.0 before 2025.1.3.
- CVE-2026-10699High
A missing release of memory after effective lifetime vulnerability has been found in the Custom Reports module of Progress MOVEit Transfer. It affects versions 2025.0.0 before 2025.0.8, 2025.1.0 before 2025.1.4, and 2026.0.0 before 2026.0.1.
- CVE-2026-10698High
A vulnerability in Progress MOVEit Transfer's Custom Reports module involves improper neutralization of special elements in data query logic. This allows an attacker to manipulate queries, potentially leading to unauthorized data access.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.