Loading story…
Progress Software disclosed and patched two vulnerabilities in MOVEit Automation, including CVE-2026-4670, a critical authentication-bypass flaw, and CVE-2026-5174, a high-severity privilege-escalation issue. The company warned that successful exploitation could let attackers access business data, gain administrative control, and expose sensitive information in the managed file transfer platform. Progress said customers must upgrade to the latest version using the full installer and shut down the software during the upgrade process to fully remediate the flaws.
External exposure appears significant. Internet scanning cited by Cybersecurity Dive found more than 1,440 internet-connected systems running vulnerable MOVEit Automation versions, including 16 associated with state and local government agencies, while Censys separately issued an advisory tracking CVE-2026-4670. The disclosure drew added attention because MOVEit products have previously been targeted in high-impact exploitation campaigns, increasing concern that exposed and unpatched systems could become immediate targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Censys issued an advisory covering CVE-2026-4670, the MOVEit Automation authentication-bypass vulnerability. The advisory highlighted the flaw after Progress's disclosure and patch release.
Reporting on the MOVEit Automation flaws said Shodan data showed more than 1,440 internet-connected devices running vulnerable versions, including 16 associated with state and local government agencies. This quantified the potential exposure following disclosure of the bugs.
Progress Software disclosed and patched two MOVEit Automation vulnerabilities: critical authentication bypass CVE-2026-4670 and high-severity privilege escalation CVE-2026-5174. The company instructed customers to upgrade using the full installer and shut down the software during the update process.
Progress released a patch for a MOVEit Transfer resource-consumption vulnerability, according to later reporting. The reference does not provide additional technical details in the supplied content.
Progress disclosed and released a fix for CVE-2024-5806, an authentication-bypass vulnerability affecting MOVEit Transfer. The issue was documented by Tenable in coverage published on June 25, 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
censys.com
Open sourcecybersecuritydive.com
Open sourcelinkedin.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed two critical vulnerabilities in **MOVEit Automation**, including **CVE-2026-4670**, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to **CWE-305** and included it in a security bulletin covering both **CVE-2026-4670** and **CVE-2026-5174**. The advisories affect multiple MOVEit Automation release branches, including versions prior to **2025.0.9**, **2024.1.8**, and releases before **2024.0.0**, with broader vendor and government guidance also referencing affected builds such as **2025.1.4 and earlier**, **2025.0.8 and earlier**, **2024.1.7 and earlier**, and **2024.0.0 and earlier**. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Jun 29, 2026
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability, **CVE-2024-5806**, warning that a threat actor could exploit the flaw to take control of affected systems. CISA urged organizations to review Progress Software’s June 2024 alert and apply updates, while reporting indicated the bug was being attacked within hours of public disclosure, raising the risk of rapid compromise for internet-exposed file-transfer servers. The new exploitation wave revived scrutiny of the earlier MOVEit crisis, when the Clop ransomware-linked extortion campaign compromised organizations across the private and public sectors. Reported victims and affected entities included technology and IT firms, state and federal agencies, schools tied to the Teachers Insurance and Annuity Association of America retirement fund, Norton LifeLock owner Gen Digital, Vancouver Transit Police, Missouri agencies, and Extreme Networks, underscoring how vulnerabilities in widely deployed managed file-transfer software can cascade into broad supply-chain and data-theft incidents.
Jun 29, 2026
Progress Software has disclosed and patched a high-severity vulnerability, tracked as CVE-2025-10932, affecting the AS2 module of MOVEit Transfer. The flaw impacts multiple versions, including MOVEit Transfer 2025.0.2 (17.0.2) and prior, 2024.1.6 (16.1.6) and prior, 2023.1.15 (15.1.15) and prior, as well as 2023.0 and 2024.0 and earlier releases. Security advisories urge users and administrators to review the official updates and apply necessary patches to mitigate the risk associated with this vulnerability. The Canadian Centre for Cyber Security has also issued an alert referencing the same vulnerability, emphasizing the importance of prompt remediation. No evidence of exploitation in the wild has been reported at this time, but the critical nature of the flaw and the widespread use of MOVEit Transfer in enterprise environments make timely patching essential to prevent potential compromise.
Jun 29, 2026