This vulnerability (CVE-2026-15966) in Progress MOVEit Transfer is classified as CWE-942, indicating a permissive cross-domain security policy that includes untrusted domains. This misconfiguration can allow unauthorized cross-origin interactions that compromise security boundaries. The affected versions are those before 2025.1.5 and from 2026.0.0 up to 2026.0.3. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could lead to unauthorized access or manipulation of data due to the permissive cross-domain security policy allowing untrusted domains. This impacts confidentiality, integrity, and availability of the affected MOVEit Transfer installations. The CVSS score of 7.5 indicates a high impact vulnerability exploitable over the network but requiring user interaction and with high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review and tighten cross-domain security policies in MOVEit Transfer configurations if possible. Monitor vendor communications for updates and apply patches promptly once released.