CVE-2026-4670

—

CVSS 3.1

9.8 critical

EPSS

6%p92

Published

Apr 30, 2026 (Apr 30, 2026)

Modified

Jun 17, 2026

Description

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Vendors: progress
Products: moveit automation
Weakness: CWE-305
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.6%)

In the news5 stories

Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)

Help Net SecurityJun 8, 10:28 UTC · Jun 8, 2026Vulnerability CVE-2026-4670 CVE-2026-5174 CVE-2023-34362

Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams

Help Net SecurityMay 10, 00:00 UTC · May 10, 2026Vulnerability in the wildCVE-2026-41940 CVE-2026-4670 CVE-2026-5174+4 CVEs

CVE-2026-4670

In the news5 stories

Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)

Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams

ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or

MOVEit automation flaws could enable full system compromise

Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass