The vulnerability arises from insecure storage of sensitive session information within Progress MOVEit Transfer, allowing local disclosure of that data. An attacker who obtains local access can read session tokens or related data, potentially enabling further exploitation such as session hijacking or credential compromise. The vulnerability carries a CVSS 7.3 score, indicating a high risk of confidentiality loss.

The affected product is Progress MOVEit Transfer. Versions prior to 2025.1.6, as well as releases beginning with 2026.0.0 through 2026.0.3, are vulnerable. Administrators should confirm that their deployments are on a patched release version.

The flaw is exploitable by local users; remote exploitation is not indicated. Because the EPSS score is < 1% and the vulnerability is not in the CISA KEV catalog, the likelihood of widespread exploitation remains uncertain, but the CVSS score reflects the potential severity if the vulnerability is abused. Organizations should treat this as a high‑priority issue, especially in environments where local accounts have broad access to the MOVEit Transfer installation.