Progress MOVEit Automation vulnerabilities

8 CVEs affecting Progress MOVEit Automation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-8488, published 2026-05-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-12677, published 2020-05-14. Medium severity, CVSS 6.1. EPSS: 1.9% chance of exploitation in the next 30 days. An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to…
CVE-2026-4670, published 2026-04-30. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from…
CVE-2026-5174, published 2026-04-30. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before…
CVE-2026-8486, published 2026-05-20. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0…
CVE-2026-8488, published 2026-05-20. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from…
CVE-2026-8485, published 2026-05-20. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-8487, published 2026-05-20. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0…
CVE-2024-4563, published 2024-05-22. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.