EUVD-2026-31115
GHSA-cpwg-526g-9gc5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); uncontrolled allocation yields availability-only impact (A:H, C:N/I:N) within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
AnalysisAI
Denial of service in Progress MOVEit Automation (versions before 2025.0.11 and 2025.1.0 before 2025.1.7) lets remote unauthenticated attackers exhaust server memory through an uncontrolled allocation flaw, degrading or crashing the managed file-transfer scheduling service. The CVSS 7.5 rating reflects availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, EPSS is negligible at 0.01%, and CISA SSVC scores exploitation as 'none' with partial technical impact - indicating a real but low-urgency issue.
Technical ContextAI
MOVEit Automation is the workflow/scheduling component of Progress Software's MOVEit managed file transfer (MFT) suite, used to orchestrate automated file transfer tasks. The root cause is CWE-789 (Uncontrolled Memory Allocation): the application allocates memory based on an attacker-influenced size or count without validating it against a sane upper bound, allowing a single request to consume disproportionate memory. Because the CVSS vector is network-facing (AV:N) with no scope change (S:U), the excessive allocation occurs within the affected service process itself, leading to resource exhaustion rather than data compromise. The affected CPE is cpe:2.3:a:progress:moveit_automation across all sub-versions within the stated ranges.
RemediationAI
Vendor-released patch: upgrade to MOVEit Automation 2025.0.11 (for the 2025.0.x and earlier branch) or 2025.1.7 (for the 2025.1.x branch), whichever matches your deployment, per the Progress release notes at https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html. No official workaround is published; as compensating controls until patching, restrict network reachability to the MOVEit Automation service by placing it behind a firewall or VPN and limiting inbound access to known management hosts, and put a reverse proxy or WAF in front to enforce request size/rate limits that blunt oversized allocation requests - noting that aggressive rate/size limits may interfere with legitimate large automated transfer jobs and should be tuned against normal workflow volumes. Monitor service memory utilization and configure process resource caps/auto-restart so an exhaustion event degrades gracefully rather than taking the host down.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today