CVE-2026-15967 in MOVEit Transfer
Summary
by MITRE • 07/24/2026
Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
Progress MOVEit Transfer contains a critical insufficient session expiration vulnerability that allows attackers to maintain unauthorized access to systems through prolonged session validity periods. This weakness enables persistent exploitation where authenticated sessions do not properly terminate after defined time intervals or upon user logout, creating extended attack windows for malicious actors who have obtained valid credentials. The vulnerability affects versions prior to 2025.1.5 and specifically impacts releases from 2026.0.0 through 2026.0.2, representing a significant security gap in session management protocols.
The technical flaw manifests in the application's session handling mechanisms where session tokens remain active beyond recommended security thresholds. This deficiency allows attackers to leverage stolen or compromised session identifiers for extended periods without requiring re-authentication, effectively bypassing normal access controls and authorization checks. The vulnerability aligns with CWE-613, which addresses insufficient session expiration, and represents a direct violation of secure session management best practices outlined in NIST SP 800-171 and ISO/IEC 27001 security standards.
From an operational impact perspective, this vulnerability creates substantial risk for organizations relying on MOVEit Transfer for file transfer operations. Attackers can exploit the prolonged session validity to perform unauthorized data access, modification, or exfiltration activities while remaining undetected within the system. The extended attack window significantly increases the potential damage scope and makes traditional monitoring approaches less effective in detecting unauthorized activities. This vulnerability particularly affects environments where sensitive data transfer occurs and where session management is critical for maintaining security boundaries.
Organizations should implement immediate mitigations including applying the patched versions 2025.1.5 and 2026.0.3 respectively, which address the session expiration timing issues. System administrators should also configure shorter session timeout values and implement additional monitoring controls to detect anomalous session behavior. The remediation efforts should include reviewing existing session management policies and ensuring proper implementation of session invalidation mechanisms upon user logout or system inactivity. Security teams must conduct comprehensive vulnerability assessments across all affected systems and establish incident response procedures for potential exploitation attempts targeting this weakness.