MOVEit Automation EUVD-2026-31121

Exploitation requires network reachability to the MOVEit Automation service endpoint and the ability to send repeated requests; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed, so internet-exposed or broadly network-accessible instances are directly at risk against default configurations. The specific triggering condition is the unbounded resource allocation on the request-handling path - the flood exploits the absence of throttling limits (CWE-770). Limiting factors: the attacker must be able to reach the listening service (deployments restricted to internal management networks or behind rate-limiting proxies are substantially harder to hit at effective volume), and the impact is availability-only, so a successful attack disrupts service but does not grant access, data, or code execution. Only versions before 2025.0.11 and 2025.1.0-2025.1.6 are affected.

The signals point to a genuine but moderate-priority availability risk rather than an urgent exploitation crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack - the reason it scores 7.5 - but the impact is confined to availability (C:N/I:N/A:H). CISA's SSVC framing corroborates this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'yes' (the flood can be scripted at scale), and Technical Impact is 'partial' (disruption, not full compromise). EPSS is very low at 0.04% (12th percentile), and there is no KEV listing and no public exploit identified, so this is not currently being weaponized. The 'Automatable: yes' plus 'PR:N' combination is the main reason not to defer patching indefinitely - a DoS that requires no credentials and can be scripted is attractive against internet-exposed MFT infrastructure. No key signals conflict; the low EPSS despite a high CVSS is expected for an availability-only, non-exploited issue.

An attacker who can reach the MOVEit Automation service over the network scripts a high-rate stream of requests against the unthrottled endpoint, causing the process to allocate resources faster than it can reclaim them. The service degrades or crashes, halting scheduled file-transfer automation for the organization until it is restarted or the flood stops. No public exploit is identified at time of analysis, but the low attack complexity and lack of authentication make such a script straightforward to build.