What is the CVSS score of CVE-2026-8486?

CVE-2026-8486 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of MOVEit Automation are affected by CVE-2026-8486?

Progress MOVEit Automation deployments are vulnerable to service disruption attacks that can halt file-transfer operations essential to business workflows.. A patch is available.

How to fix or mitigate CVE-2026-8486?

Within 24 hours, inventory all MOVEit Automation deployments and identify current version numbers to determine exposure scope; alert operations teams to potential availability risks. Within 7 days, deploy vendor patches to all affected systems-upgrade to version 2025.0.11 (for 2025.0.x track) or version 2025.1.7 (for 2025.1.x track) and validate service restoration post-deployment. Within 30 days, enable request-rate limiting or WAF rules to protect against resource-exhaustion attacks, establish monitoring baselines to detect flooding attempts, and document recovery procedures.

MOVEit Automation CVE-2026-8486

EUVD-2026-31121 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-20 ProgressSoftware

GHSA-3rgf-7jf4-5qfc

Denial Of Service Moveit Automation Progress Software

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated flood with no user interaction (AV:N/AC:L/PR:N/UI:N); resource exhaustion yields availability-only impact (C:N/I:N/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 12:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 12:23 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 12:23 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 12:23 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 20, 2026 - 16:02 vuln.today

Patch available

May 20, 2026 - 16:01 EUVD

DescriptionNVD

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

AnalysisAI

Denial of service in Progress MOVEit Automation before 2025.0.11 and 2025.1.x before 2025.1.7 lets remote unauthenticated attackers exhaust availability by flooding the service with requests that allocate resources without limits or throttling. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%), but the CVSS 7.5 rating reflects a clean network, no-authentication path to disrupting the file-transfer automation engine. Impact is limited to availability - no data confidentiality or integrity loss occurs.

Technical ContextAI

MOVEit Automation is the scheduling and workflow-orchestration companion to Progress's MOVEit managed file transfer (MFT) platform, coordinating automated file movements, tasks, and integrations across enterprise systems. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): a request-handling path accepts and services incoming work without enforcing an upper bound on memory, connections, threads, or other finite resources. An attacker who can repeatedly submit such requests (the 'Flooding' behavior noted by the vendor) drives the process toward resource starvation. The affected component is identified by the CPE cpe:2.3:a:progress_software:moveit_automation:*:*:*:*:*:*:*:*, covering all builds prior to the fixed releases.

RemediationAI

Vendor-released patch: upgrade to MOVEit Automation 2025.0.11 (for the 2025.0.x and earlier line) or 2025.1.7 (for the 2025.1.x line), whichever matches your deployed branch, per the Progress fixed-issues advisory at https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html. Because the attack is remote and unauthenticated, until you can patch, reduce internet exposure of the MOVEit Automation service - restrict inbound access to its listening endpoints to known management networks or a VPN, and place it behind a reverse proxy, WAF, or firewall that can enforce connection rate-limiting and per-source request throttling to blunt flooding attempts; the trade-off is that aggressive rate limits may throttle legitimate high-volume automation jobs, so tune thresholds against normal workload. Monitor for abnormal spikes in connections, memory, or CPU on the host as an early indicator of an active flood.