What is the CVSS score of CVE-2026-8487?

CVE-2026-8487 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of MOVEit Automation are affected by CVE-2026-8487?

Progress MOVEit Automation versions before 2025.0.11 and 2025.1.x before 2025.1.7 contain hardcoded credentials accessible via unauthenticated remote access due to incorrect default permissions.. A patch is available.

How to fix or mitigate CVE-2026-8487?

Within 24 hours, obtain and document the current version of all Progress MOVEit Automation instances in your environment to identify systems requiring patches. Within 7 days, deploy patched versions-2025.0.11 or later for the 2025.0.x line and 2025.1.7 or later for the 2025.1.x line-to all affected systems, prioritizing those in internet-facing or sensitive network segments. Within 30 days, audit and rotate all embedded credentials previously managed by MOVEit Automation, validate system functionality after patching, and implement network access controls to restrict unauthorized exposure.

MOVEit Automation CVE-2026-8487

EUVD-2026-31120 HIGH

Incorrect Default Permissions (CWE-276)

2026-05-20 ProgressSoftware

GHSA-58jp-6f6m-4v4f

Privilege Escalation Information Disclosure Moveit Automation Progress Software

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Confidentiality-only disclosure of stored secrets; CWE-276 over-permissive resource realistically implies some authenticated/local access, so PR:L rather than PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 12:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 12:23 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 12:23 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 12:23 NVD

6.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 20, 2026 - 16:02 vuln.today

Patch available

May 20, 2026 - 16:01 EUVD

DescriptionNVD

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

AnalysisAI

Sensitive-data exposure in Progress MOVEit Automation allows remote attackers to retrieve embedded secrets because the product ships with incorrect default permissions (CWE-276), affecting all versions before 2025.0.11 and the 2025.1.x line before 2025.1.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.02%, 7th percentile), and CISA SSVC rates exploitation as none and non-automatable, so despite the high CVSS this is not currently a widespread exploitation risk.

Technical ContextAI

MOVEit Automation is Progress Software's scheduling and workflow engine (formerly MOVEit Central) that automates secure managed file transfers, orchestrating tasks such as encryption, script execution, and connections to remote FTP/SFTP/cloud endpoints. To perform these transfers it stores embedded credentials and other secrets for the systems it connects to. The root cause is CWE-276 (Incorrect Default Permissions): resources holding these embedded secrets are created or shipped with overly permissive default access controls, so principals who should not be able to read them can retrieve the stored sensitive data. The single CPE in scope is cpe:2.3:a:progress_software:moveit_automation:*:*:*:*:*:*:*:*, indicating the flaw is in MOVEit Automation itself rather than an underlying OS or third-party library.

RemediationAI

Vendor-released patch: upgrade MOVEit Automation to 2025.0.11 for the 2025.0.x line, or to 2025.1.7 for the 2025.1.x line, as documented in the Progress fixed-issues release notes at https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html. Until patching, reduce exposure by restricting network access to the MOVEit Automation management and service interfaces to trusted administrative hosts only (via host firewall or network segmentation), which limits reachability but does not close local access; additionally rotate any credentials and secrets stored or embedded in MOVEit Automation after upgrading, since an incorrect-permissions flaw means previously stored secrets should be treated as potentially disclosed. Where vendor hardening guidance exists, tighten file/object permissions on the affected data stores, accepting that manual permission changes can break automation tasks if applied incorrectly and should be validated against Progress documentation first.