The flaw arises because sessions in Progress MOVEit Transfer do not expire properly. An attacker who acquires or re‑uses an OAuth token can maintain a valid session beyond its intended lifespan, enabling them to bypass standard access controls and potentially access or alter sensitive data. This weakness is captured as CWE‑613, indicating insufficient session expiration that permits persistent unauthorized use.

Affected versions include all releases of MOVEit Transfer older than 2025.1.6 and the 2026.0.x series through 2026.0.3. Any instance employing OAuth authentication is vulnerable. Users operating these versions face a significant risk of unauthorized access.

The CVSS metric of 7.5 places the vulnerability in the high‑severity category, while an EPSS score of less than 1% suggests low but non‑zero exploitation probability. The issue is not listed in the CISA KEV catalog. The attack vector is remote: an adversary must obtain an OAuth token or manipulate the session mechanism, but no local privilege escalation or other preconditions are required.