Progress warns of critical MOVEit Automation auth bypass flaw

Progress Software has issued a critical advisory for its MOVEit Automation MFT platform, warning that CVE‑2026‑4670 allows unauthenticated attackers to bypass authentication and gain full control of the system.

The flaw affects all releases prior to 2025.1.5, 2025.0.9, and 2024.1.8 and can be exploited without any user interaction or privileges. Progress recommends an immediate upgrade to the latest patched release, noting that the upgrade will temporarily bring the system offline. In addition to the auth bypass, the company released a separate patch for CVE‑2026‑5174, a privilege‑escalation vulnerability caused by improper input validation.

A Shodan scan shows more than 1,400 exposed MOVEit Automation instances worldwide, including several U.S. government agencies, though it is unclear how many have been remediated. The platform serves over 3,000 enterprise customers and 100,000 users globally, making the vulnerability highly impactful. The advisory stresses that the only effective remediation is a full installer upgrade, which will cause an outage during the process. Progress has not yet confirmed any active exploitation of the flaw in the wild.