CVE-2026-11903: Progress MOVEit Transfer XSS Vulnerability – Patch Guidance

Technical summary

CVE-2026-11903 is an improper input neutralization flaw (CWE-79) in the Ad Hoc module of MOVEit Transfer. The application fails to adequately sanitize user-supplied input before rendering it in web page responses, enabling stored or reflected XSS attacks. With a CVSS 3.1 score of 8.0 (HIGH), the attack vector is network-based, requires low complexity, and demands authenticated access with user interaction. Successful exploitation grants high confidentiality, integrity, and availability impact within the user's session scope.

Business impact

This vulnerability enables credential theft, unauthorized file transfers, and lateral movement within organizations relying on MOVEit Transfer for secure file exchange. An attacker with valid credentials can craft malicious URLs or messages that, when clicked by other users, execute arbitrary JavaScript in their browsers—potentially compromising sensitive documents, exfiltrating data, or pivoting to connected systems. For enterprises using MOVEit Transfer as a critical collaboration hub, exploitation could disrupt file transfer operations and trigger incident response costs.

Affected systems

Progress MOVEit Transfer versions 2026.0.0 before 2026.0.1, 2025.1.0 before 2025.1.4, and 2025.0.0 before 2025.0.8 are vulnerable. The Ad Hoc module is specifically affected. Organizations running any of these versions should prioritize assessment and patching immediately.

Exploitability

Exploitation requires valid credentials to access MOVEit Transfer and the ability to inject malicious input into the Ad Hoc module. The attacker must then trick another authenticated user into clicking a crafted link or viewing a page containing the payload. While not trivially exploitable by unauthenticated threat actors, the barrier is significantly lower than zero-day scenarios, and internal threat actors or compromised accounts pose meaningful risk. No public exploit code has been documented as in-the-wild.

Remediation

Upgrade affected MOVEit Transfer installations to patched versions: 2026.0.1 or later, 2025.1.4 or later, or 2025.0.8 or later. Verify the specific patch version against the Progress vendor advisory. As an interim control, restrict the Ad Hoc module to authorized users only, enable web application firewalls with XSS detection rules, and implement Content Security Policy (CSP) headers to mitigate reflected XSS impact.

Patch guidance

Progress has released security updates addressing this vulnerability. Determine your current MOVEit Transfer version and map it to the affected ranges above. If running 2026.0.0, upgrade to 2026.0.1+. If running 2025.1.0–2025.1.3, upgrade to 2025.1.4+. If running 2025.0.0–2025.0.7, upgrade to 2025.0.8+. Consult Progress's official security advisory and release notes to confirm patch availability and any prerequisite steps. Test patches in a non-production environment before deploying to production.

Detection guidance

Monitor for suspicious input patterns in Ad Hoc module logs, such as HTML entities, script tags, or JavaScript event handlers in user-submitted content or URL parameters. Implement endpoint detection and response (EDR) rules to flag unusual script execution originating from MOVEit Transfer processes. Review web server access logs for URLs containing encoded XSS payloads (e.g., %3Cscript%3E, <iframe>). Use web application firewalls to block requests containing known XSS patterns before they reach MOVEit Transfer.

Why prioritize this

Although not yet in the CISA Known Exploited Vulnerabilities (KEV) catalog, this HIGH-severity vulnerability affects a widely deployed enterprise file-transfer platform. The requirement for authenticated access reduces the attack surface compared to unauthenticated RCE flaws, but internal threat actors and compromised accounts remain credible threats. Organizations should treat this as medium-to-high priority for patching within 2–4 weeks, depending on their risk profile and whether the Ad Hoc module is actively used.

Risk score, explained

The CVSS 3.1 score of 8.0 reflects high impact (confidentiality, integrity, and availability all marked as high) balanced against the requirement for valid authentication and user interaction. The network attack vector and low complexity increase severity, but the authenticated-user prerequisite and UI interaction requirement prevent a critical rating. For organizations where MOVEit Transfer handles highly sensitive data or is internet-facing, the business risk may exceed the numerical CVSS score.

Frequently asked questions