PT-2026-36124 · Progress · Moveit Automation

Airbus Seclab + 4 · Published 2026-04-30 · Updated 2026-06-02 · CVE-2026-5174

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Automation versions 2025.1.0 through 2025.1.4 MOVEit Automation versions 2025.0.0 through 2025.0.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions prior to 2024.0.0

Description Improper input validation in Progress Software MOVEit Automation allows for privilege escalation.

Recommendations Update versions 2025.1.0 through 2025.1.4 to 2025.1.5. Update versions 2025.0.0 through 2025.0.8 to 2025.0.9. Update versions 2024.0.0 through 2024.1.7 to 2024.1.8. Update versions prior to 2024.0.0 to 2024.0.0 or later.

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-5174

Affected Products

Moveit Automation

References · 19

• https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5174 · Security Note
• https://t.me/CVEtracker/52320 · Telegram Post
• https://twitter.com/jlabernathy/status/2052085996368408709 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2051380108783497245 · Twitter Post
• https://twitter.com/integ_sec/status/2053448737402351891 · Twitter Post
• https://t.me/cveNotify/162046 · Telegram Post
• https://twitter.com/samilaiho/status/2050087132455178493 · Twitter Post
• https://twitter.com/lyrie_ai/status/2061632926765162955 · Twitter Post
• https://twitter.com/shah_sheikh/status/2051327840176709893 · Twitter Post
• https://twitter.com/dailytechonx/status/2051719850012078303 · Twitter Post
• https://twitter.com/NoctisIntel/status/2052761653322899945 · Twitter Post
• https://t.me/true_secator/8175 · Telegram Post
• https://twitter.com/ethicalhack3r/status/2050158082911519113 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2051451099907846309 · Twitter Post