Brief Summary: CVE-2026-4670 Critical Authentication Bypass in Progress MOVEit Automation

Introduction

A critical authentication bypass in Progress Software MOVEit Automation allows unauthenticated remote attackers to gain access through the service backend command port interfaces. It carries a CVSS 3.1 base score of 9.8. The MOVEit product line has a history as a target for mass exploitation, including the 2023 breach that affected over 2000 organizations and 60 million individuals, so any organization running an affected version should give this vulnerability immediate attention.

MOVEit Automation is a managed file transfer automation platform that IT teams worldwide use to schedule, manage, and monitor file transfers across internal systems, external partners, and cloud environments. It supports compliance with regulations such as HIPAA, GDPR, and PCI DSS, and is widely deployed in enterprise environments that handle sensitive data. Because it is the layer that orchestrates those transfers, it is a particularly attractive target for threat actors who want access to business-critical data flows.

Technical Information

CVE-2026-4670 is classified under CWE-305 (Authentication Bypass by Primary Weakness). The vulnerability exists within the service backend command port interfaces of MOVEit Automation. The full CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, the flaw is reachable over the network, has low attack complexity, needs no privileges and no user interaction, and has high impact on confidentiality, integrity, and availability.

Researchers at Airbus SecLab discovered the vulnerability. It was disclosed alongside a companion vulnerability, CVE-2026-5174, an improper input validation flaw that enables privilege escalation. Together the two form a particularly dangerous chain. An attacker could first exploit CVE-2026-4670 to bypass authentication entirely on the backend command port, then use CVE-2026-5174 to escalate privileges and take full administrative control of the MOVEit Automation environment.

The backend command port interfaces are the core attack surface. Because the CVSS vector specifies no required privileges (PR:N) and no user interaction (UI:N), a completely unauthenticated remote attacker can exploit the flaw. The low attack complexity (AC:L) also indicates that no special conditions or race conditions are needed. Bypassing the authentication mechanism is straightforward.

Successful exploitation gives an attacker unauthorized access to the automation platform. From there, the attacker could manipulate scheduled file transfers, exfiltrate data in transit, modify transfer configurations, or pivot to connected systems and partners. Add the privilege escalation from CVE-2026-5174, and the attacker would have the same level of control as a legitimate administrator.

Affected Systems and Versions

The following version branches of MOVEit Automation are affected:

Organizations running any version of MOVEit Automation prior to the fixed releases listed above should treat their deployments as vulnerable. The only remediation Progress Software has confirmed is applying the full installer for a patched release. No workaround, hotfix, or configuration change mitigates this vulnerability.

To verify the installed version:

1. Open the MOVEit Automation Web Admin.
2. Open the Help menu.
3. Select About.
4. Check the version information displayed.

Customers on a current maintenance agreement can get the upgrade through the Progress Community portal.

While they plan the upgrade, security teams should monitor audit logs for indicators of compromise, including unexpected privilege escalation events, unauthorized access attempts, or other anomalous activity that could suggest exploitation of the backend command port interfaces.

Vendor Security History

The MOVEit product line has had serious security problems before. The most significant incident involved CVE-2023-34362, a vulnerability in MOVEit Transfer (a related product in the same family) that was exploited at mass scale in 2023. That campaign affected over 2000 organizations and approximately 60 million individuals, and it was one of the largest data breaches of that year. The Cl0p ransomware group was attributed as the primary threat actor behind it.

Critical vulnerabilities keep recurring in the MOVEit ecosystem, which is a strong reason to stay on current patch levels and watch for new advisories. Progress Software distributes critical security updates to customers through its Progress Alert and Notification Service.

References

• MOVEit Automation Critical Security Alert Bulletin, April 2026 (CVE-2026-4670, CVE-2026-5174)
• NVD Entry for CVE-2026-4670
• CVE Record: CVE-2026-4670
• MOVEit Automation Product Page
• CISA Known Exploited Vulnerabilities Catalog
• MOVEit Breach: Timeline of the Largest Hack of 2023 (Hadrian)
• CWE-305: Authentication Bypass by Primary Weakness