Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass

Summary: Progress Software released updates for two MOVEit Automation flaws: CVE-2026-4670, a 9.8-rated authentication bypass, and CVE-2026-5174, a 7.7-rated improper input validation bug that could allow privilege escalation. Progress said the flaws may allow authentication bypass and privilege escalation through service backend command port interfaces, leading to unauthorized access, administrative control, and data exposure, and no workarounds resolve the issues.
Key Takeaway: Progress does not say these flaws are exploited in the wild, but prior MOVEit Transfer flaws were exploited by the Cl0p ransomware gang, and this is a managed file transfer system whose compromise has already meant data exposure at scale.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-4670 CVE-2026-5174
Related: ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, Web Socket Skimmers and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026