MOVEit Automation CVE-2026-5174

Requires authenticated access to MOVEit Automation with low-level privileges (PR:L). Exploitation is network-based (AV:N) with low attack complexity (AC:L) and requires no user interaction (UI:N), meaning any authenticated user can potentially trigger the vulnerability through normal interface access without special timing or race conditions. The scope change (S:C) indicates the vulnerability affects resources beyond the attacker's authorized access boundaries, suggesting exploitation does not require administrative privileges or access to specific restricted features. Limiting factors: attacker must have valid credentials to the MOVEit Automation platform, which typically requires prior account provisioning or credential compromise. Organizations with strict authentication controls, network segmentation limiting access to trusted sources, or minimal user populations face reduced exposure.

Real-world risk is substantial despite no confirmed active exploitation. The CVSS 7.7 HIGH rating reflects genuine threat: network attack vector with low complexity means remote authenticated attackers can exploit this without specialized skills or timing windows. The Changed scope elevation significantly increases impact - an attacker with limited access can disrupt availability system-wide, not just within their permission boundaries. The privilege escalation tag indicates potential for attackers to gain unauthorized elevated access before triggering denial of service. EPSS data not provided, but the straightforward exploitation conditions (PR:L/AC:L) suggest high exploitability once technical details emerge. Progress bundled this with CVE-2026-4670 in a Critical Security Alert, indicating vendor assessment of serious risk. The broad version range affected (all pre-2024.0.0 versions plus multiple 2024.x and 2025.x branches) creates large attack surface across Progress's MFT customer base. Key decision factor: organizations with internet-facing MOVEit Automation instances and multiple user tiers face highest risk, as any authenticated user could potentially escalate and disrupt operations. The availability impact (A:H) with scope change makes this a business continuity concern for file transfer operations.

An authenticated attacker with low-level user credentials to MOVEit Automation submits specially crafted input through the web interface or API that bypasses validation checks. The malformed input triggers a resource exhaustion condition or exploits a privilege escalation flaw, allowing the attacker to disrupt MOVEit Automation services across the entire platform, impacting all users and file transfer workflows regardless of organizational boundaries. The Changed scope means the attacker's limited initial access translates to system-wide availability impact.