Back Securityaffairs.Co

MOVEit automation flaws could enable full system compromise

Securityaffairs.Co •Pierluigi Paganini • May 4, 2026

Progress fixes critical MOVEit Automation flaws, including an authentication bypass bug that could let attackers gain unauthorized access to systems. Progress Software addressed two vulnerabilities in MOVEit Automation, a critical authentication bypass flaw tracked as CVE-2026-4670 and a privilege escalation issue tracked as CVE-2026-5174. If exploited, these bugs could allow attackers to gain unauthorized access […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical MOVEit Vulnerabilities Expose Organizations to Data Breaches Progress Software has issued urgent advisories regarding critical vulnerabilities in its MOVEit Automation platform, specifically CVE-2026-4670 and CVE-2026-5174. These vulnerabilities allow attackers to bypass authentication and escalate privileges, potentially leading to unauthorized access and data exposure. The flaws affect numerous organizations, including U.S. local and state government agencies, with over 1,400 MOVEit Automation instances exposed online. The vulnerabilities were disclosed on April 30, 2026, and require immediate patching to mitigate risks. This follows a significant data breach in 2023, where the Cl0p ransomware gang exploited a zero-day vulnerability in MOVEit, impacting over 2,100 organizations and 62 million individuals. The current situation emphasizes the ongoing risk associated with MOVEit software and the necessity for organizations to update their systems promptly to avoid similar incidents. 11 sources 74

Extracted Entities

MOVEit automation flaws could enable full system compromise

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)