PT-2026-36123 · Progress · Moveit Automation

Airbus Seclab + 4 · Published 2026-04-30 · Updated 2026-06-05 · CVE-2026-4670

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MOVEit Automation versions prior to 2024.1.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions 2025.0.0 through 2025.0.8

Description An improper authentication flaw allows attackers to bypass authentication entirely. This can lead to unauthorized administrative control, data exposure, privilege escalation, and lateral movement across enterprise networks.

Recommendations Update versions prior to 2024.0.0 to version 2024.1.8 or later. Update versions 2024.0.0 through 2024.1.7 to version 2024.1.8 or later. Update versions 2025.0.0 through 2025.0.8 to version 2025.0.9 or later.

Fix

Weakness Enumeration

CWE-305

Related Identifiers

BDU:2026-07888

CVE-2026-4670

Affected Products

Moveit Automation

References · 48

• https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4670 · Security Note
• https://twitter.com/FriendOfTheInst/status/2054281632396275981 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2051124402289324464 · Twitter Post
• https://twitter.com/RedLegg/status/2051328799661343087 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2051380108783497245 · Twitter Post
• https://twitter.com/NetSecIO/status/2050240022578708977 · Twitter Post
• https://twitter.com/evanderburg/status/2051327845495128088 · Twitter Post
• https://twitter.com/earlyn_cyber/status/2051559793748254791 · Twitter Post
• https://twitter.com/helpnetsecurity/status/2051316126190121460 · Twitter Post
• https://twitter.com/TheCyberSecHub/status/2051329348192600534 · Twitter Post
• https://twitter.com/integ_sec/status/2052765316124377371 · Twitter Post
• https://twitter.com/bettermssp/status/2058679786109652997 · Twitter Post
• https://twitter.com/ThreatAft/status/2051501998261104991 · Twitter Post