MOVEit Automation CVE-2026-8488

The CVE description specifies no feature toggle or non-default mode - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, unauthenticated exploitation at low complexity with no user interaction, so exploitation requires only network reachability to a vulnerable MOVEit Automation instance running a version before 2025.0.11 or between 2025.1.0 and 2025.1.7. The practical limiting factors are: the target's network listener must be reachable by the attacker (deployments restricted to internal or VPN-only networks are far less exposed), and the impact is confined to availability (A:H) with no path to data access or code execution. The description does not name the exact endpoint, protocol, or resource that is over-allocated, so the specific triggering interface is not confirmed from available data.

This is a moderate-priority availability issue, not a critical incident. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 purely on High availability impact with no confidentiality or integrity loss, meaning the worst case is service disruption rather than data compromise. All independent exploitation signals point low and are mutually consistent: EPSS is 0.04% (12th percentile), CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and no POC is referenced. There is no conflict between CVSS and the description - both describe unauthenticated remote DoS. The main caveat is that the underlying description is sparse (no named endpoint or protocol), so the specific attack surface is inferred from the CWE and CVSS rather than confirmed. Prioritize patching for internet-exposed MFT deployments where uptime is business-critical, but this does not warrant emergency out-of-band response.

An attacker who can reach the MOVEit Automation network listener sends crafted or high-volume requests that each trigger an unbounded resource allocation, and because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), repeats this until the service exhausts memory or connection capacity and stops processing legitimate transfers. The result is a denial of service against the file-transfer automation platform with no data disclosure or tampering. No public exploit code has been identified at time of analysis.