This vulnerability (CVE-2026-15967) in Progress MOVEit Transfer is classified as CWE-613 (Insufficient Session Expiration). It affects versions prior to 2025.1.5 and versions 2026.0.0 through 2026.0.2 inclusive. The issue involves sessions not expiring as intended, potentially allowing unauthorized continued access. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows attackers to potentially maintain unauthorized access to the MOVEit Transfer system due to insufficient session expiration controls. This can lead to compromise of confidentiality, integrity, and availability of the system and its data. The CVSS score of 7.5 reflects a high impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor vendor communications closely and consider limiting session lifetimes through configuration if possible.