Vulnerabilitycritical
Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-34362 | Unauthenticated SQL Injection in Progress MOVEit Transfer | 9.8 | 100% | KEVRansomwarePoC | KEV |
CVE-2026-4670+1 related CVE | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass | 9.8 group max | 6% |
From the original article
1 min read at helpnetsecurity.com
Progress Software has fixed a critical authentication bypass (CVE-2026-4670) and a privilege escalation (CVE-2026-5174) vulnerability in MOVEit Automation, exploitation of which “may lead to unauthorized access, administrative control, and data exposure.” The vulnerabilities were reported privately by Airbus researchers and there’s no mention of them being leveraged by attackers in the wild.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.