CVE-2026-4670

Critical

Description

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Progress Moveit Automation

PublishedApr 30, 2026

First seenApr 30, 2026

Weakness typeCWE-305CWE-305

How to fix

Update

progress moveit_automation2024.1.8, 2025.1.5 or later

Vendor advisories

community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174

Affected products

Product	Affected versions	Fixed in
progress moveit_automation	v < 2024.1.8, 2025.0.0 ≤ v < 2025.1.5	2024.1.8, 2025.1.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.