Privilege Escalation Vulnerability in MOVEit Automation by Progress Software
CVE-2026-5174

7.7HIGH

Key Information:

Vendor

Progress Software
Status
Moveit Automation
Vendor
CVE Published:
30 April 2026

Badges

📰 News Worthy

What is CVE-2026-5174?

An improper input validation vulnerability has been identified in MOVEit Automation, which could allow an attacker to gain elevated privileges within the system. This vulnerability affects multiple versions of MOVEit Automation, including those prior to specified releases, posing a risk to users who have not upgraded to the most secure versions. Organizations utilizing affected versions should prioritize implementing the necessary updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

MOVEit Automation 2025.1.0 < 2025.1.5

MOVEit Automation 2025.0.0 < 2025.0.9

MOVEit Automation 2024.0.0 < 2024.1.8

News Articles

favicon imageThe Hacker News

Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass

MOVEit Automation flaws (CVE-2026-4670, CVE-2026-5174) enable bypass and escalation, risking enterprise data exposure.

2 weeks ago

favicon imageBleepingComputer

Progress warns of critical MOVEit Automation auth bypass flaw

Progress Software warned customers to patch a critical authentication bypass vulnerability in its MOVEit Automation enterprise-grade managed file transfer (MFT) application.

2 weeks ago

References

https://community.progress.com/s/article/MOVEit-Automatio...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SecLab
Anaïs Gantet
Delphine Gourdou
Quentin Liddell
Matteo Ricordeau
.