EUVD-2026-31115
GHSA-cpwg-526g-9gc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed MOVEit Automation endpoint
-
DeliverySend crafted oversized request
-
ExploitTrigger uncontrolled memory allocation
-
ExecutionExhaust server memory
-
ImpactService crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against reachable installations of MOVEit Automation before 2025.0.11 or 2025.1.0-2025.1.6, per CVSS AV:N/AC:L/PR:N/UI:N. The practical limiting factor is network exposure: the attacker must be able to reach the MOVEit Automation service, so deployments restricted to internal management networks or behind a VPN/firewall materially reduce risk. Impact is confined to availability (service disruption/DoS) - this flaw does not yield data access or code execution, so it cannot be chained for confidentiality or integrity loss on its own. |
| Impact | Signals are largely consistent and point to a genuine but low-priority DoS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote unauthenticated reachability, which drives the 7.5 score, but the sole impact is availability (A:H; C:N/I:N) - this is a crash/resource-exhaustion issue, not a breach vector. EPSS is 0.01% (0th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, all reinforcing low real-world exploitation likelihood. There is no KEV listing and no POC identified. One conflict warrants attention: the intelligence Tags label this 'Information Disclosure,' which directly contradicts the CVSS confidentiality metric (C:N) and CWE-789 - the tag appears to be a mislabel; treat this as an availability/DoS issue unless Progress states otherwise. Net: patch on a normal maintenance cycle, not an emergency, given the memory-exhaustion nature of MFT infrastructure. |
| Exploit ScenarioDerived | A remote attacker with network access to the MOVEit Automation endpoint sends a crafted request whose parameters cause the server to allocate an excessive amount of memory. Repeating or scaling this request drives the service into memory exhaustion, crashing it or rendering scheduled file-transfer automation unavailable. No authentication or user interaction is required (PR:N/UI:N), but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Denial of service in Progress MOVEit Automation (versions before 2025.0.11 and 2025.1.0 before 2025.1.7) lets remote unauthenticated attackers exhaust server memory through an uncontrolled allocation flaw, degrading or crashing the managed file-transfer scheduling service. The CVSS 7.5 rating reflects availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, EPSS is negligible at 0.01%, and CISA SSVC scores exploitation as 'none' with partial technical impact - indicating a real but low-urgency issue.
Earlier versions of this analysis (1)
Uncontrolled memory allocation in Progress Software MOVEit Automation exposes the application to remote denial-of-service via excessive resource consumption. Unauthenticated network attackers can trigger the flaw against versions prior to 2025.0.11 and 2025.1.x prior to 2025.1.7, resulting in availability loss with no confidentiality or integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is moderated by high attack complexity.
RemediationAI
Vendor-released patch: upgrade to MOVEit Automation 2025.0.11 (for the 2025.0.x and earlier branch) or 2025.1.7 (for the 2025.1.x branch), whichever matches your deployment, per the Progress release notes at https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html. No official workaround is published; as compensating controls until patching, restrict network reachability to the MOVEit Automation service by placing it behind a firewall or VPN and limiting inbound access to known management hosts, and put a reverse proxy or WAF in front to enforce request size/rate limits that blunt oversized allocation requests - noting that aggressive rate/size limits may interfere with legitimate large automated transfer jobs and should be tuned against normal workflow volumes. Monitor service memory utilization and configure process resource caps/auto-restart so an exhaustion event degrades gracefully rather than taking the host down.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOVEit Automation is the workflow/scheduling component of Progress Software's MOVEit managed file transfer (MFT) suite, used to orchestrate automated file transfer tasks. The root cause is CWE-789 (Uncontrolled Memory Allocation): the application allocates memory based on an attacker-influenced size or count without validating it against a sane upper bound, allowing a single request to consume disproportionate memory. Because the CVSS vector is network-facing (AV:N) with no scope change (S:U), the excessive allocation occurs within the affected service process itself, leading to resource exhaustion rather than data compromise. The affected CPE is cpe:2.3:a:progress:moveit_automation across all sub-versions within the stated ranges.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); uncontrolled allocation yields availability-only impact (A:H, C:N/I:N) within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Executive ViewAI
Progress MOVEit Automation versions before 2025.0.11 and 2025.1.7 are vulnerable to an unauthenticated denial-of-service attack that can exhaust server memory and crash the file-transfer scheduling service. Organizations using MOVEit Automation for business-critical file transfers face potential service outages and operational disruption if the vulnerability is exploited. While no public exploit currently exists, the high CVSS rating (7.5) and availability-only impact warrant prompt remediation.
Apply vendor patch. Until patching is complete, restrict network access to MOVEit Automation to trusted internal networks and approved external partners, and enable memory utilization monitoring to detect anomalous consumption patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB