What is the CVSS score of CVE-2026-8488?

CVE-2026-8488 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of MOVEit Automation are affected by CVE-2026-8488?

Progress MOVEit Automation versions prior to 2025.0.11 and 2025.1.x prior to 2025.1.7 are vulnerable to remote denial-of-service attacks from unauthenticated attackers, potentially disrupting file…. A patch is available.

How to fix or mitigate CVE-2026-8488?

Within 24 hours, audit all MOVEit Automation deployments to identify affected versions and prioritize instances supporting critical workflows. Within 7 days, apply vendor patches to upgrade all instances to MOVEit Automation 2025.0.11 or later (or 2025.1.7+ for 2025.1.x users), testing patches in a non-production environment first to ensure compatibility. Within 30 days, validate all patches have been deployed across the infrastructure and implement network-level rate limiting on MOVEit endpoints as a compensating control for any instances where patching is delayed.

MOVEit Automation CVE-2026-8488

EUVD-2026-31119 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-20 ProgressSoftware

GHSA-rcwv-f9jp-p684

Denial Of Service Moveit Automation Progress Software

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity resource-exhaustion DoS with no user interaction; impact is availability-only (A:H), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 12:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 12:23 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 12:23 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 12:23 NVD

4.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 20, 2026 - 16:02 vuln.today

Patch available

May 20, 2026 - 16:01 EUVD

DescriptionNVD

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

AnalysisAI

Uncontrolled resource allocation in Progress Software MOVEit Automation lets remote unauthenticated attackers exhaust system resources and force a denial-of-service condition against affected instances (all releases before 2025.0.11 and the 2025.1.x line before 2025.1.7). The flaw carries no confidentiality or integrity impact - availability only - and there is no public exploit identified at time of analysis, with EPSS placing exploitation probability at just 0.04% (12th percentile) and CISA SSVC recording no observed exploitation.

Technical ContextAI

MOVEit Automation is Progress Software's managed file transfer (MFT) orchestration engine, used to schedule, script, and automate secure file transfer workflows across FTP/SFTP/HTTPS endpoints. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): a network-reachable code path accepts or processes input without enforcing an upper bound on memory, connections, or other resources, allowing an attacker to drive 'Excessive Allocation.' Because MOVEit Automation typically exposes network listeners to receive and coordinate transfers, an unbounded allocation in request or task handling can be driven remotely until the service degrades or crashes. The single affected CPE is cpe:2.3:a:progress_software:moveit_automation:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to MOVEit Automation 2025.0.11 (for the 2025.0 and earlier line) or 2025.1.7 (for the 2025.1.x line), as documented in the Progress release notes at https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html. Until the upgrade is applied, reduce exposure by restricting network reachability of the MOVEit Automation service to trusted management networks or a VPN and placing it behind a firewall or reverse proxy that enforces connection-rate and request-size limits - the trade-off is that legitimate remote automation clients must be explicitly allowlisted, which can disrupt distributed transfer workflows. Monitor the host for abnormal memory/CPU growth and configure service auto-restart to shorten outage windows. No product-level configuration workaround is published by the vendor, so patching remains the definitive fix; do not rely on network controls as a permanent substitute.