Improper neutralization of input during web page generation in Progress MOVEit Transfer’s Ad Hoc module leads to a stored cross‑site scripting vulnerability (CWE‑79). An attacker who can submit malicious payloads that are later rendered in a victim’s browser could execute arbitrary JavaScript. The resulting impact may include session hijacking, theft of credentials, or other actions that compromise confidentiality, integrity, and availability of the affected system.

Affected releases include all Progress MOVEit Transfer versions before 2026.0.1, before 2025.1.4, and before 2025.0.8.

The flaw carries a CVSS score of 8, classifying it as high risk. Its EPSS score of < 1% indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web interface of the Ad‑Hoc module, where a user can submit content that is stored and subsequently rendered to other users; no privileges beyond module access are required.