Loading vulnerability…
Privilege Escalation in Progress MOVEit Automation Backend Command Port Interfaces
CVE-2026-5174 is an improper input validation vulnerability in Progress Software MOVEit Automation affecting the service backend command port interfaces. The flaw allows specially crafted input supplied by a low-privileged authenticated user to be processed without sufficient validation, enabling privilege escalation. The issue affects MOVEit Automation from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, and unsupported versions prior to 2024.0.0. The vulnerability is remotely exploitable over the network and was disclosed alongside CVE-2026-4670, a separate authentication bypass flaw in the same interface surface.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged authenticated attacker to elevate privileges within MOVEit Automation and potentially reach administrative control. This can enable unauthorized administrative operations, bypass of intended security boundaries, disruption of automation workflows, and exposure of sensitive data handled by the platform. Available reporting also indicates the vulnerability may have significant availability impact and, when chained with the companion authentication bypass issue, can contribute to unauthorized access, administrative control, and broader data exposure.
If you can’t patch tonight, do this now.
No vendor workaround is available. Until patching is completed, reduce exposure by restricting access to MOVEit Automation backend interfaces to trusted sources only and limiting network reachability wherever operationally possible. Increased monitoring of audit logs and administrative activity may help detect exploitation attempts, but these measures do not remediate the flaw.
Patch, then assume compromise.
Upgrade MOVEit Automation to a fixed release using the vendor-provided full installer. Fixed versions are 2025.1.5 for the 2025.1 branch, 2025.0.9 for the 2025.0 branch, and 2024.1.8 for the 2024 branch. Instances running versions prior to 2024.0.0 should be upgraded to a supported fixed version. Because the upgrade requires service outage, maintenance planning is necessary. After patching, review audit logs for signs of anomalous activity, unauthorized access attempts, or unexpected privilege escalation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.