Progress Software has issued a critical security alert for its MOVEit Automation software. Two severe vulnerabilities have been discovered that could allow attackers to bypass authentication and escalate their privileges.
Because of the critical nature of these flaws, administrators are urged to apply the latest security patches immediately to prevent unauthorized access and data exposure.
The security bulletin released on April 30, 2026, highlights two distinct vulnerabilities discovered by researchers at Airbus SecLab.
The first is an authentication bypass flaw tracked as CVE-2026-4670. The second is a privilege escalation vulnerability caused by improper input validation, tracked as CVE-2026-5174.
Both of these security gaps exist within the service backend command port interfaces of the software. If a cybercriminal successfully exploits these weaknesses, they can gain administrative control over the system.
This level of unauthorized access poses a massive risk, as it can lead directly to sensitive data exposure and full network compromise. Administrators should look for signs of unexpected privilege changes or unusual activity in their system audit logs.
These vulnerabilities impact multiple versions of MOVEit Automation. Progress Software has released patched versions to address both the authentication bypass and the privilege escalation flaws.
Organizations must review their current installations and update to the corresponding secure release:
To verify which version is currently running, administrators can open the MOVEit Automation Web Admin portal, navigate to the Help menu, and check the About section.
The only way to completely fix these issues is by upgrading to a patched release using the full installer provided by Progress Software.
The development team strongly recommends that all customers under active maintenance access the Progress Community portal to download the necessary updates.
Administrators must prepare for a temporary system outage. The upgrade process requires taking the system offline while the full installer runs.
Customers who do not have a current maintenance agreement should contact a Progress sales representative or their partner immediately to resolve their licensing and secure their systems.
Finally, organizations can sign up for the Progress Alert and Notification Service to receive future security updates directly via email.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…