Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass

Source: The Hacker News

Vulnerabilities

• CVE‑2026‑4670 – Authentication bypass (CVSS 9.8)
  Details:

• CVE‑2026‑5174 – Improper input validation leading to potential privilege escalation (CVSS 7.7)
  Details:

Progress Software stated that “critical and high vulnerabilities in MOVEit Automation may allow authentication bypass and privilege escalation through the service backend command port interfaces.” Exploitation could lead to unauthorized access, administrative control, and data exposure.

Affected Versions

• MOVEit Automation ≤ 2025.1.4 (fixed in 2025.1.5)
• MOVEit Automation ≤ 2025.0.8 (fixed in 2025.0.9)
• MOVEit Automation ≤ 2024.1.7 (fixed in 2024.1.8)

Credits

The vulnerabilities were discovered and reported by Airbus SecLab researchers Anaïs Gantet, Delphine Gourdou, Quentin Liddell, and Matteo Ricordeau.

Mitigation

• No workarounds are available; the only remediation is to apply the provided patches.
• Although Progress has not reported active exploitation in the wild, users should update to the fixed versions promptly, especially given the history of MOVEit Transfer flaws being leveraged by ransomware groups such as Cl0p.

For additional context on prior MOVEit Transfer issues, see: