Moveit Automation
Monthly
Denial of service in Progress MOVEit Automation (versions before 2025.0.11 and 2025.1.0 before 2025.1.7) lets remote unauthenticated attackers exhaust server memory through an uncontrolled allocation flaw, degrading or crashing the managed file-transfer scheduling service. The CVSS 7.5 rating reflects availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, EPSS is negligible at 0.01%, and CISA SSVC scores exploitation as 'none' with partial technical impact - indicating a real but low-urgency issue.
Uncontrolled resource allocation in Progress Software MOVEit Automation lets remote unauthenticated attackers exhaust system resources and force a denial-of-service condition against affected instances (all releases before 2025.0.11 and the 2025.1.x line before 2025.1.7). The flaw carries no confidentiality or integrity impact - availability only - and there is no public exploit identified at time of analysis, with EPSS placing exploitation probability at just 0.04% (12th percentile) and CISA SSVC recording no observed exploitation.
Sensitive-data exposure in Progress MOVEit Automation allows remote attackers to retrieve embedded secrets because the product ships with incorrect default permissions (CWE-276), affecting all versions before 2025.0.11 and the 2025.1.x line before 2025.1.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.02%, 7th percentile), and CISA SSVC rates exploitation as none and non-automatable, so despite the high CVSS this is not currently a widespread exploitation risk.
Denial of service in Progress MOVEit Automation before 2025.0.11 and 2025.1.x before 2025.1.7 lets remote unauthenticated attackers exhaust availability by flooding the service with requests that allocate resources without limits or throttling. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%), but the CVSS 7.5 rating reflects a clean network, no-authentication path to disrupting the file-transfer automation engine. Impact is limited to availability - no data confidentiality or integrity loss occurs.
Improper input validation in Progress MOVEit Automation enables authenticated low-privilege attackers to escalate privileges and cause high-impact denial of service across container boundaries. Affecting all versions prior to 2025.1.5, 2025.0.9, and 2024.1.8, this network-accessible vulnerability with low attack complexity allows attackers to disrupt availability system-wide. Progress issued a Critical Security Alert Bulletin addressing this issue alongside CVE-2026-4670 in their April 2026 advisory. No public exploit identified at time of analysis, but the straightforward attack path (AV:N/AC:L/PR:L) and Changed scope indicate significant real-world risk for organizations running unpatched instances.
Authentication bypass in Progress MOVEit Automation allows remote unauthenticated attackers to completely circumvent authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. Affects all versions before 2025.0.9, all 2024.x versions before 2024.1.8, and all versions prior to 2024.0.0. Progress Software has released patches for all supported versions. CVSS 9.8 critical severity with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit or active exploitation confirmed at time of analysis, though the authentication bypass nature and MOVEit's history as a high-value target make this a priority remediation candidate.
The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Progress MOVEit Automation Web Admin. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Denial of service in Progress MOVEit Automation (versions before 2025.0.11 and 2025.1.0 before 2025.1.7) lets remote unauthenticated attackers exhaust server memory through an uncontrolled allocation flaw, degrading or crashing the managed file-transfer scheduling service. The CVSS 7.5 rating reflects availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, EPSS is negligible at 0.01%, and CISA SSVC scores exploitation as 'none' with partial technical impact - indicating a real but low-urgency issue.
Uncontrolled resource allocation in Progress Software MOVEit Automation lets remote unauthenticated attackers exhaust system resources and force a denial-of-service condition against affected instances (all releases before 2025.0.11 and the 2025.1.x line before 2025.1.7). The flaw carries no confidentiality or integrity impact - availability only - and there is no public exploit identified at time of analysis, with EPSS placing exploitation probability at just 0.04% (12th percentile) and CISA SSVC recording no observed exploitation.
Sensitive-data exposure in Progress MOVEit Automation allows remote attackers to retrieve embedded secrets because the product ships with incorrect default permissions (CWE-276), affecting all versions before 2025.0.11 and the 2025.1.x line before 2025.1.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) reflects a pure confidentiality breach with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.02%, 7th percentile), and CISA SSVC rates exploitation as none and non-automatable, so despite the high CVSS this is not currently a widespread exploitation risk.
Denial of service in Progress MOVEit Automation before 2025.0.11 and 2025.1.x before 2025.1.7 lets remote unauthenticated attackers exhaust availability by flooding the service with requests that allocate resources without limits or throttling. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.04%), but the CVSS 7.5 rating reflects a clean network, no-authentication path to disrupting the file-transfer automation engine. Impact is limited to availability - no data confidentiality or integrity loss occurs.
Improper input validation in Progress MOVEit Automation enables authenticated low-privilege attackers to escalate privileges and cause high-impact denial of service across container boundaries. Affecting all versions prior to 2025.1.5, 2025.0.9, and 2024.1.8, this network-accessible vulnerability with low attack complexity allows attackers to disrupt availability system-wide. Progress issued a Critical Security Alert Bulletin addressing this issue alongside CVE-2026-4670 in their April 2026 advisory. No public exploit identified at time of analysis, but the straightforward attack path (AV:N/AC:L/PR:L) and Changed scope indicate significant real-world risk for organizations running unpatched instances.
Authentication bypass in Progress MOVEit Automation allows remote unauthenticated attackers to completely circumvent authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. Affects all versions before 2025.0.9, all 2024.x versions before 2024.1.8, and all versions prior to 2024.0.0. Progress Software has released patches for all supported versions. CVSS 9.8 critical severity with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit or active exploitation confirmed at time of analysis, though the authentication bypass nature and MOVEit's history as a high-value target make this a priority remediation candidate.
The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Progress MOVEit Automation Web Admin. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.