Based on the description, the attack vector is via input stored in the Ad Hoc module, leading to a stored XSS. The vulnerability permits execution of arbitrary scripts when affected pages are viewed, potentially enabling session hijacking, defacement, or malware delivery.

Affected versions are all MOVEit Transfer releases before 2025.1.6 and those from 2026.0.0 up to 2026.0.3; deployments using older releases or not yet patched to 2026.0.4 are potentially vulnerable

The CVSS score of 8 indicates high severity. The EPSS score of 0.00444 indicates a very low but non‑zero exploitation probability. Based on the description we infer that exploitation requires the ability to submit data to the Ad Hoc module; once stored, any user who views the affected page will execute the injected script. The vulnerability is not listed in the CISA KEV catalog, but that does not reduce its risk.