CVE-2026-15967 describes an insufficient session expiration vulnerability in Progress MOVEit Transfer. Affected versions are those prior to 2025.1.5 and from 2026.0.0 up to 2026.0.3. The issue is categorized under CWE-613, indicating that sessions do not expire appropriately, which could lead to unauthorized access. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow an attacker to maintain or reuse a session beyond its intended expiration, potentially leading to unauthorized access to sensitive data and full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Progress MOVEit Transfer advisories for updates and apply any forthcoming patches promptly. Until a patch is available, consider reducing session timeout durations and enforcing stricter session management policies as temporary mitigations if feasible.