CVE-2026-11903: Progress MOVEit Transfer XSS Vulnerability

CVE-2026-11903 Overview

CVE-2026-11903 is a cross-site scripting (XSS) vulnerability in the Ad Hoc module of Progress MOVEit Transfer. The flaw stems from improper neutralization of user input during web page generation, tracked as [CWE-79]. An authenticated attacker can inject malicious script content that executes in the browser of another user who interacts with the crafted content. Successful exploitation impacts confidentiality, integrity, and availability within the victim's session context. Progress has released fixed builds in versions 2026.0.1, 2025.1.4, and 2025.0.8.

Critical Impact
An authenticated attacker can execute arbitrary script in a victim's browser session, enabling session token theft, unauthorized file transfer actions, and account compromise within MOVEit Transfer.

Affected Products

Progress MOVEit Transfer 2026.0.0 before 2026.0.1
Progress MOVEit Transfer 2025.1.0 before 2025.1.4
Progress MOVEit Transfer 2025.0.0 before 2025.0.8

Discovery Timeline

2026-07-08 - CVE-2026-11903 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-11903

Vulnerability Analysis

The vulnerability resides in the Ad Hoc Transfer module of MOVEit Transfer, which enables users to send files and messages to internal and external recipients. The module fails to properly sanitize or encode user-supplied input before rendering it in generated web pages. An authenticated attacker submits crafted input containing HTML or JavaScript payloads. When a legitimate user views the affected page, the browser interprets the injected content as executable script.

The attack requires low privileges but also user interaction, meaning the victim must load the affected page for the payload to trigger. Because MOVEit Transfer handles sensitive file transfer workflows, successful script execution can lead to session hijacking, unauthorized file access, and manipulation of transfer requests. The EPSS score for this issue is 0.3%, reflecting current exploitation prediction data.

Root Cause

The root cause is missing or insufficient output encoding when the Ad Hoc module renders attacker-controlled input into HTML responses. Input that should be treated as data is instead parsed as markup by the browser, satisfying the classic conditions for stored or reflected XSS as described in [CWE-79].

Attack Vector

An authenticated user with access to the Ad Hoc Transfer functionality submits a crafted payload through an input field or transfer parameter. The payload is stored or reflected back through the web interface. When another authenticated user, potentially an administrator, views the content, the script executes in their session. The attacker can then exfiltrate cookies, perform actions on behalf of the victim, or redirect to attacker-controlled infrastructure. Details are documented in the Progress MOVEit Transfer Bulletin.

Detection Methods for CVE-2026-11903

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URIs stored in Ad Hoc Transfer message fields or metadata.
Outbound requests from user browsers to unfamiliar domains immediately after loading MOVEit Transfer pages.
Anomalous session activity such as unexpected file downloads or transfer creations following a message view.

Detection Strategies

Inspect MOVEit Transfer web server logs for POST requests containing encoded script fragments such as %3Cscript%3E, onerror=, or javascript: in Ad Hoc parameters.
Deploy web application firewall rules that flag HTML and JavaScript tokens submitted through Ad Hoc Transfer endpoints.
Correlate authentication events with abnormal DOM-related browser telemetry from endpoint agents monitoring user sessions.

Monitoring Recommendations

Enable verbose audit logging for the Ad Hoc module and forward logs to a centralized SIEM for retention and analysis.
Monitor for privilege changes or new administrative sessions occurring shortly after Ad Hoc message interactions.
Alert on Content Security Policy violation reports generated by MOVEit Transfer pages if CSP reporting is enabled.

How to Mitigate CVE-2026-11903

Immediate Actions Required

Upgrade MOVEit Transfer to 2026.0.1, 2025.1.4, or 2025.0.8 depending on the deployed branch.
Restrict access to the Ad Hoc Transfer module to trusted users while patches are being staged.
Rotate session tokens and administrative credentials if suspicious Ad Hoc activity is identified during log review.

Patch Information

Progress has published fixed versions in the Progress MOVEit Transfer Bulletin. Administrators should apply 2026.0.1, 2025.1.4, or 2025.0.8 on all MOVEit Transfer nodes, including standby and disaster recovery instances. Verify the patch level after deployment through the administration console.

Workarounds

Disable the Ad Hoc Transfer module if it is not required for business operations until patches are applied.
Enforce a strict Content Security Policy on the MOVEit Transfer web tier to limit inline script execution.
Require multi-factor authentication for all MOVEit Transfer accounts to reduce the impact of session compromise.

bash

# Verify installed MOVEit Transfer version on Windows host
Get-ItemProperty "HKLM:\SOFTWARE\Ipswitch\MOVEit Transfer\*" | Select-Object DisplayName, DisplayVersion