{"id":799,"date":"2026-05-04T17:51:02","date_gmt":"2026-05-04T17:51:02","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=799"},"modified":"2026-05-04T17:51:02","modified_gmt":"2026-05-04T17:51:02","slug":"progress-patches-critical-moveit-automation-bug-enabling-authentication-bypass","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=799","title":{"rendered":"Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 04, 2026<\/span><\/span>Vulnerability \/ Enterprise Software<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentication bypass.<\/p>\n

MOVEit Automation (formerly Central) is a secure, server-based managed file transfer (MFT) solution used to schedule and automate file movement workflows in enterprise environments without requiring any custom scripts.\u00a0<\/p>\n

The vulnerabilities in question are CVE-2026-4670<\/a> (CVSS score: 9.8), an authentication bypass vulnerability, and CVE-2026-5174<\/a> (CVSS score: 7.7), an improper input validation vulnerability that could allow privilege escalation.<\/p>\n

\u00abCritical and high vulnerabilities in MOVEit Automation may allow authentication bypass and privilege escalation through the service backend command port interfaces,\u00bb Progress Software said<\/a> in an advisory. \u00abExploitation may lead to unauthorized access, administrative control, and data exposure.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The shortcomings affect the following versions –<\/p>\n