Vulnerabilities

TI-2026-07453 CVE-2026-8488 · GHSA-rcwv-f9jp-p684

Resource allocation without limits in Progress MOVEit Automation

LOW 33

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00364 Published 2026-05-20 Fixed in 2025.0.11, 2025.1.7 CWE-770

TI-2026-07452 CVE-2026-8487 · GHSA-58jp-6f6m-4v4f

LOW 33

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0028 Published 2026-05-20 Fixed in 2025.0.11, 2025.1.7 CWE-276

TI-2026-07451 CVE-2026-8486 · GHSA-3rgf-7jf4-5qfc

LOW 39

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-20 Fixed in 2025.0.11, 2025.1.7 CWE-770

TI-2026-07450 CVE-2026-8485 · GHSA-cpwg-526g-9gc5

LOW 33

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00348 Published 2026-05-20 Fixed in 2025.0.11, 2025.1.7 CWE-789

TI-2026-04517 CVE-2026-5174 · GHSA-9pjg-ppfq-29g7

MEDIUM 46

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03321 Published 2026-04-30 Fixed in 2025.1.5, 2025.0.9 +1 CWE-20

TI-2026-04065 CVE-2026-4670 · GHSA-2cqj-hxr6-hc5p

MEDIUM 57

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0504 Published 2026-04-30 Fixed in 2025.0.9, 2024.1.8 CWE-305

TI-2024-04249 CVE-2024-4563 · GHSA-9v7j-9r5r-v99p

LOW 32

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00235 Published 2024-05-22 Fixed in 2024.0.0 CWE-327

TI-2020-10081 CVE-2020-12677 · GHSA-9qr2-f94j-cm59

LOW 31

An issue was discovered in Progress MOVEit Automation Web Admin.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01908 Published 2020-05-14 No fix listed CWE-79