Progress Software MOVEit Automation vulnerabilities

Latest Progress Software MOVEit Automation CVEs

Newest publication first

1. CVE-2026-8488 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation

   Published 2026-05-20

   High·CVSS 7.5 EPSS 0.36%

   Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

2. CVE-2026-8487 Incorrect default permissions vulnerability in Progress Software MOVEit Automation

   Published 2026-05-20

   High·CVSS 7.5 EPSS 0.28%

   Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

3. CVE-2026-8486 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation

   Published 2026-05-20

   High·CVSS 7.5 EPSS 0.40%

   Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

4. CVE-2026-8485 Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation

   Published 2026-05-20

   High·CVSS 7.5 EPSS 0.35%

   Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

5. CVE-2026-5174 Improper Access Control Vulnerability in Progress MOVEit Automation

   Published 2026-04-30

   High·CVSS 8.8 EPSS 3.3%

   Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

6. CVE-2026-4670 Improper Authentication vulnerability in Progress MOVEit Automation

   Published 2026-04-30

   Critical·CVSS 9.8 EPSS 5.0%

   Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

7. CVE-2024-4563 The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

   Published 2024-05-22

   High·CVSS 7.5 EPSS 0.24%

   The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.