Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation

CVE-2026-4670 is an unauthenticated authentication bypass in Progress MOVEit Automation, specifically tied to the product's *service backend command port interfaces*. Per the CNA/NVD record, it affects 2025.0.0 through 2025.0.8, 2024.0.0 through 2024.1.7, and versions prior to 2024.0.0; fixed builds are 2025.0.9 and 2024.1.8, while older unsupported branches must be upgraded onto a supported line.

The vendor's 9.8/CRITICAL score is technically fair for a reachable target: no auth, no user interaction, full impact. But for enterprise patch triage, reality bites harder than CVSS: MOVEit Automation is a niche MFT orchestrator, commonly placed on restricted admin networks, and Censys observed fewer than 100 exposed web admin interfaces globally as of May 5, 2026. That exposure friction, plus no KEV listing, no confirmed in-the-wild exploitation, and no public PoC at disclosure, pushes this down one bucket to HIGH for most fleets.

Why this verdict

• Pre-auth remote is real: vendor CVSS 9.8 is not inflated from a pure exploitability standpoint; no auth and no user interaction always deserve attention.
• Attacker position usually collapses from internet to internal/VPN: the flaw needs network access to a MOVEit Automation interface, and many real deployments keep that surface off the public internet. That is a concrete downward adjustment from the baseline.
• Exposure population looks narrow: Censys saw <100 exposed admin interfaces globally on May 5, 2026 and specifically warned that higher counts from favicon-only searches were inflated. Narrow population means narrower operational risk than a commodity edge service.
• No field exploitation signal yet: not KEV-listed, no confirmed active exploitation in the reviewed sources, and no public PoC at disclosure. That removes the biggest amplifier that would otherwise keep this in CRITICAL.
• Blast radius is integration-heavy, not universal: compromise can be serious because MFT orchestration stores secrets and partner trust, but the damage is bounded by what that specific MOVEit Automation node can reach.

Why not higher?

I am not keeping this at CRITICAL because the attack chain has one giant real-world choke point: reachability. A pre-auth auth bypass on a product that is commonly internal, operationally niche, and observed with a relatively small exposed population is not the same enterprise-wide emergency as a mass-exposed VPN, firewall, or email gateway zero-day. The lack of KEV status, public exploit code, or confirmed campaigns further argues against the top bucket.

Why not lower?

I am not pushing this to MEDIUM because once the interface is reachable, the bug is ugly: unauthenticated, low-complexity, high-impact compromise of a system that often holds sensitive automation credentials. Even a limited exposed population is enough to make this a serious priority for any organization running the product, especially if partner-facing or externally reachable.

1. Restrict exposure now — Put the MOVEit Automation admin/backend interfaces behind VPN, jump-host, or source-IP allowlisting and remove direct internet reachability. For a HIGH verdict, deploy this within 30 days; if the instance is already internet-facing, do it on an emergency basis because this is the main friction point holding the score down.
2. Tighten east-west access — Limit which internal subnets can reach the server and especially any backend command or admin ports. This cuts off post-initial-access abuse from a compromised workstation or VPN account; deploy within 30 days.
3. Hunt for workflow abuse — Review recent task edits, new schedules, changed destinations, and unusual use of service accounts or stored transfer credentials. This does not prevent exploitation, but it is your fastest way to catch abuse of the orchestration plane; stand this up within 30 days.
4. Constrain service account blast radius — Reduce permissions on accounts and secrets used by MOVEit Automation jobs, and validate outbound destinations. If the product is compromised, least privilege is what stops the incident from becoming partner-wide data loss; complete within 30 days.
5. Inventory every instance — Use CMDB, software inventory, and network discovery to identify all MOVEit Automation nodes and whether they are on vulnerable branches. You cannot prioritize exposure reduction if you still do not know where the schedulers live; finish the inventory within 30 days.

Run this on the target Windows host that has MOVEit Automation installed, from an elevated PowerShell session. Example: powershell -ExecutionPolicy Bypass -File .\check-moveit-automation-cve-2026-4670.ps1; it needs local admin only to ensure registry access across standard uninstall paths.

# check-moveit-automation-cve-2026-4670.ps1

# Purpose: Determine whether a Windows host appears vulnerable to CVE-2026-4670 in Progress MOVEit Automation.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param()

$ErrorActionPreference = 'Stop'

function Get-MoveItAutomationInstall {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $hits = foreach ($p in $paths) {
        Get-ItemProperty -Path $p -ErrorAction SilentlyContinue | Where-Object {
            $_.DisplayName -match 'MOVEit Automation'
        } | Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher
    }

    return $hits | Select-Object -First 1
}

function Parse-Version {
    param([string]$VersionString)

    if ([string]::IsNullOrWhiteSpace($VersionString)) {
        return $null
    }

    # Keep only numeric dot-separated prefix, e.g. 17.0.8 from "17.0.8" or "17.0.8 build xyz"

    if ($VersionString -match '([0-9]+(?:\.[0-9]+){1,3})') {
        try {
            return [version]$matches[1]
        } catch {
            return $null
        }
    }

    return $null
}

function Test-CVE20264670 {
    param([version]$v)

    if (-not $v) {
        return @{ State = 'UNKNOWN'; Reason = 'Unable to parse installed version.' }
    }

    # Version mapping from vendor/CNA and runZero reporting:

    # 2024.1.7 == 16.1.7 (fixed in 16.1.8 / 2024.1.8)

    # 2025.0.8 == 17.0.8 (fixed in 17.0.9 / 2025.0.9)

    # 2025.1.x corresponds to 17.1.x and is not listed as affected for CVE-2026-4670 by the CNA record.


    $fixed2024 = [version]'16.1.8'
    $fixed2025 = [version]'17.0.9'
    $branch171 = [version]'17.1.0'

    if ($v -lt [version]'16.0.0') {
        return @{ State = 'VULNERABLE'; Reason = 'Unsupported pre-2024 branch is considered affected; upgrade to a supported fixed branch.' }
    }

    if ($v -ge [version]'16.0.0' -and $v -lt $fixed2024) {
        return @{ State = 'VULNERABLE'; Reason = '2024.x branch before 2024.1.8 / 16.1.8.' }
    }

    if ($v -ge [version]'17.0.0' -and $v -lt $fixed2025) {
        return @{ State = 'VULNERABLE'; Reason = '2025.0.x branch before 2025.0.9 / 17.0.9.' }
    }

    if ($v -ge $branch171) {
        return @{ State = 'PATCHED'; Reason = '17.1.x is not listed as affected for CVE-2026-4670 in the CNA/NVD record.' }
    }

    if ($v -ge $fixed2024 -and $v -lt [version]'17.0.0') {
        return @{ State = 'PATCHED'; Reason = '2024.x branch at or above 2024.1.8 / 16.1.8.' }
    }

    if ($v -ge $fixed2025 -and $v -lt $branch171) {
        return @{ State = 'PATCHED'; Reason = '2025.0.x branch at or above 2025.0.9 / 17.0.9.' }
    }

    return @{ State = 'UNKNOWN'; Reason = 'Version fell outside expected mapping; verify against vendor release notes.' }
}

try {
    $app = Get-MoveItAutomationInstall

    if (-not $app) {
        Write-Output 'UNKNOWN - MOVEit Automation not found in standard uninstall registry locations.'
        exit 2
    }

    $parsed = Parse-Version -VersionString $app.DisplayVersion
    $result = Test-CVE20264670 -v $parsed

    $msg = '{0} - {1}; Product="{2}" Version="{3}" InstallLocation="{4}"' -f $result.State, $result.Reason, $app.DisplayName, $app.DisplayVersion, $app.InstallLocation
    Write-Output $msg

    switch ($result.State) {
        'PATCHED'    { exit 0 }
        'VULNERABLE' { exit 1 }
        default      { exit 2 }
    }
}
catch {
    Write-Output ('UNKNOWN - Error during verification: ' + $_.Exception.Message)
    exit 2
}

Sources

1. NVD CVE-2026-4670
2. Progress MOVEit Automation Critical Security Alert Bulletin – April 2026
3. Censys advisory on CVE-2026-4670
4. runZero: Find impacted MOVEit Automation assets
5. BleepingComputer coverage of Progress warning
6. Canadian Centre for Cyber Security AV26-410
7. CCB Belgium advisory on CVE-2026-4670
8. PwnDefend note on exposure and exploitability