High severity7.7NVD Advisory· Published Apr 30, 2026· Updated May 4, 2026

CVE-2026-5174

Description

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.

This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Affected products

Progress (organisation)/Moveit Automation
cpe:2.3:a:progress:moveit_automation:*:*:*:*:*:*:*:*
Range: <2024.1.8

Patches

Vulnerability mechanics

References

community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174nvdVendor Advisory

News mentions

11th May – Threat Intelligence Report
Check Point Research · May 11, 2026
⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More
The Hacker News · May 11, 2026
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scams
Help Net Security · May 10, 2026
Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass
The Hacker News · May 4, 2026
Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670)
Help Net Security · May 4, 2026
Progress warns of critical MOVEit Automation auth bypass flaw
BleepingComputer · May 4, 2026

cvss	0.501
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000