Critical Authentication Bypass Flaws Disclosed in Progress MOVEit Automation
Vulnerability Disclosure · 10 sources · Updated 4mo ago · First seen Apr 30, 2026
Progress Software disclosed two critical vulnerabilities in MOVEit Automation, including CVE-2026-4670, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to CWE-305 and included it in a security bulletin covering both CVE-2026-4670 and CVE-2026-5174.
The advisories affect multiple MOVEit Automation release branches, including versions prior to 2025.0.9, 2024.1.8, and releases before 2024.0.0, with broader vendor and government guidance also referencing affected builds such as 2025.1.4 and earlier, 2025.0.8 and earlier, 2024.1.7 and earlier, and 2024.0.0 and earlier. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
