This vulnerability (CVE-2026-15966) in Progress MOVEit Transfer is classified under CWE-942, indicating a permissive cross-domain security policy that includes untrusted domains. This misconfiguration can allow unauthorized cross-origin interactions, potentially leading to compromise of sensitive data and system integrity. The affected versions are those before 2025.1.5 and versions starting at 2026.0.0 but before 2026.0.3. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with high impact on confidentiality, integrity, and availability, requiring user interaction and high attack complexity. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows potentially untrusted domains to bypass cross-domain security restrictions, which can lead to unauthorized access or manipulation of sensitive data within MOVEit Transfer. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability, meaning exploitation could result in significant data compromise and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor vendor communications closely and consider restricting access or applying compensating controls to limit exposure until a patch is available.