Loading vulnerability…
Authentication Bypass in Progress MOVEit Automation
CVE-2026-4670 is a critical authentication bypass vulnerability in Progress Software MOVEit Automation affecting the service backend command port interfaces. The flaw allows a remote attacker to bypass authentication and gain unauthorized access to the application without valid credentials. It is network exploitable, requires no privileges, and does not require user interaction. Affected versions include MOVEit Automation 2025.0.0 through 2025.0.8, 2024.0.0 through 2024.1.7, and unsupported versions prior to 2024.0.0. Multiple reports also indicate the 2025.1 branch was affected through 2025.1.4 and fixed in 2025.1.5, but the CVE description provided explicitly lists the 2025.0 and 2024.x branches and versions prior to 2024.0.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can provide unauthorized access to MOVEit Automation with high impact to confidentiality, integrity, and availability. An attacker may be able to access and manipulate managed file transfer workflows, modify transfer configurations, expose sensitive data handled by the platform, and disrupt automation operations. Reporting also indicates the flaw may be chainable with CVE-2026-5174 to achieve administrative control.
If you can’t patch tonight, do this now.
No vendor workaround or configuration-based fix is available according to the available reporting. Until patching is completed, exposure can be reduced by restricting network access to MOVEit Automation backend interfaces and limiting access to trusted sources only, while reviewing audit logs for anomalous access or other suspicious activity. These measures are compensating controls and not a substitute for upgrading.
Patch, then assume compromise.
Upgrade MOVEit Automation to a vendor-fixed release. Based on the available information, fixed versions include 2025.0.9 and 2024.1.8, and unsupported versions prior to 2024.0.0 should be upgraded to a supported fixed release. Multiple supporting references also state that the 2025.1 branch is fixed in 2025.1.5. The vendor indicates remediation requires applying the full installer upgrade.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.