CVE-2026-5174

—

CVSS 3.1

8.8 high

EPSS

3%p88

Published

Apr 30, 2026 (Apr 30, 2026)

Modified

Jun 17, 2026

Description

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Vendors: progress
Products: moveit automation
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news4 stories

Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)

Help Net SecurityJun 8, 10:28 UTC · Jun 8, 2026Vulnerability CVE-2026-4670 CVE-2026-5174 CVE-2023-34362

Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams

Help Net SecurityMay 10, 00:00 UTC · May 10, 2026Vulnerability in the wildCVE-2026-41940 CVE-2026-4670 CVE-2026-5174+4 CVEs

MOVEit automation flaws could enable full system compromise

Security AffairsMay 4, 21:32 UTC · May 4, 2026Ransomware in the wildCVE-2026-4670 CVE-2026-5174 CVE-2023-34362

Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass

The Hacker NewsMay 4, 16:34 UTC · May 4, 2026Vulnerability in the wildCVE-2026-4670 CVE-2026-5174