Loading story…
Progress Software disclosed two critical vulnerabilities in MOVEit Automation, including CVE-2026-4670, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to CWE-305 and included it in a security bulletin covering both CVE-2026-4670 and CVE-2026-5174.
The advisories affect multiple MOVEit Automation release branches, including versions prior to 2025.0.9, 2024.1.8, and releases before 2024.0.0, with broader vendor and government guidance also referencing affected builds such as 2025.1.4 and earlier, 2025.0.8 and earlier, 2024.1.7 and earlier, and 2024.0.0 and earlier. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported that the MOVEit Automation vulnerabilities CVE-2026-4670 and CVE-2026-5174 were privately reported by Airbus researchers. The flaws could be chained to gain administrative control, but the report said there was no indication of in-the-wild exploitation.
The Canadian Centre for Cyber Security issued alert AV26-410 referencing Progress's advisories and urged users and administrators to review the vendor bulletin and apply the necessary updates for MOVEit Automation.
Progress published security advisories for critical MOVEit Automation vulnerabilities including CVE-2026-4670 and CVE-2026-5174, identifying affected version branches and fixed releases. The advisories covered versions such as 2025.0.0 before 2025.0.9, 2024.0.0 before 2024.1.8, and prior branches, and directed customers to update.
Progress Software received a report at security@progress.com about CVE-2026-4670, an improper authentication vulnerability in MOVEit Automation described as an authentication bypass issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehipaajournal.com
Open sourcerunzero.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed and patched two vulnerabilities in **MOVEit Automation**, including **`CVE-2026-4670`**, a critical authentication-bypass flaw, and **`CVE-2026-5174`**, a high-severity privilege-escalation issue. The company warned that successful exploitation could let attackers access business data, gain administrative control, and expose sensitive information in the managed file transfer platform. Progress said customers must upgrade to the latest version using the **full installer** and shut down the software during the upgrade process to fully remediate the flaws. External exposure appears significant. Internet scanning cited by Cybersecurity Dive found more than **1,440** internet-connected systems running vulnerable MOVEit Automation versions, including **16** associated with state and local government agencies, while Censys separately issued an advisory tracking **`CVE-2026-4670`**. The disclosure drew added attention because MOVEit products have previously been targeted in high-impact exploitation campaigns, increasing concern that exposed and unpatched systems could become immediate targets.
Jun 29, 2026
Progress Software has disclosed and patched a high-severity vulnerability, tracked as CVE-2025-10932, affecting the AS2 module of MOVEit Transfer. The flaw impacts multiple versions, including MOVEit Transfer 2025.0.2 (17.0.2) and prior, 2024.1.6 (16.1.6) and prior, 2023.1.15 (15.1.15) and prior, as well as 2023.0 and 2024.0 and earlier releases. Security advisories urge users and administrators to review the official updates and apply necessary patches to mitigate the risk associated with this vulnerability. The Canadian Centre for Cyber Security has also issued an alert referencing the same vulnerability, emphasizing the importance of prompt remediation. No evidence of exploitation in the wild has been reported at this time, but the critical nature of the flaw and the widespread use of MOVEit Transfer in enterprise environments make timely patching essential to prevent potential compromise.
Jun 29, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026