Improper input validation vulnerability in Progress Software MOVEit Automation

CVE-2026-5174 is an improper input validation flaw in Progress MOVEit Automation that lets a remote attacker with low privileges elevate privileges through the product's service backend command port interfaces. Affected ranges are 2025.1.0 to before 2025.1.5, 2025.0.0 to before 2025.0.9, 2024.0.0 to before 2024.1.8, and all versions prior to 2024.0.0. In plain English: if someone can already authenticate to MOVEit Automation at a low level and talk to the vulnerable interface, they may be able to jump to much stronger control over the automation server and the credentials it brokers.

The vendor's HIGH 7.7 rating is technically defensible, but it overstates enterprise urgency when taken alone. The decisive friction is the same one the CVSS vector admits: PR:L. This is not a clean unauthenticated internet-to-admin break; it is a post-auth privilege escalation in a product with a relatively small exposed population, no known exploitation, no KEV listing, and no public exploit chain proving reliable weaponization with the companion auth bypass.

Why this verdict

• Start at vendor 7.7 HIGH because successful exploitation can hand over the MFT automation control plane and disrupt or expose sensitive file workflows
• First downgrade: PR:L means post-auth. The attacker must already have a low-privileged MOVEit Automation foothold or chain another bug such as CVE-2026-4670, which narrows the reachable population sharply
• Second downgrade: exposure is limited. Censys saw fewer than 100 exposed admin interfaces and explicitly warned that larger favicon-based counts overstate real internet reach
• Third downgrade: no exploitation evidence. No KEV entry, no public PoC, and no reliable public exploit chain mean this is not behaving like an internet fire right now
• Floor stays at MEDIUM because blast radius is still real. On a box that automates sensitive transfers, admin-level control can expose connector secrets, alter jobs, and interrupt business-critical data movement

Why not higher?

If this were unauthenticated remote, or if there were confirmed chaining with CVE-2026-4670 and active exploitation, this would jump fast. But today the attack path still depends on prior access and a product with a comparatively small exposed footprint.

Why not lower?

This is still a privilege-escalation flaw in a high-trust MFT orchestration product, not a cosmetic bug. A compromised MOVEit Automation server can become a springboard into file-transfer credentials, partner connections, and operational disruption, so dismissing it as LOW would understate the business impact.

1. Restrict interface reachability — Limit MOVEit Automation web and backend service access to admin jump hosts and approved management networks only. For a MEDIUM verdict there is no mitigation SLA; do this as normal hardening, then use the patch as the primary fix inside the 365-day remediation window.
2. Tighten low-privileged accounts — Audit all non-admin MOVEit Automation users, service operators, and stale access paths; remove unused accounts and force strong auth for the rest. This matters because the main exploit prerequisite is already having low privileges; with no mitigation SLA for MEDIUM, fold this into your next identity hygiene cycle while planning remediation.
3. Monitor workflow and connector changes — Alert on new admins, modified tasks, changed connectors, credential-store access, and unexpected job failures or pauses. That will not stop exploitation, but it shrinks dwell time if someone uses the bug after gaining access; again, no mitigation SLA for MEDIUM, so deploy as practical risk reduction.
4. Segment downstream transfer targets — Ensure the accounts and keys used by MOVEit Automation have only the minimum rights needed on SMB shares, SFTP destinations, cloud buckets, and partner endpoints. This limits follow-on blast radius if the product is taken over, and it can be implemented on normal change cadence because MEDIUM has no mitigation SLA.

Run this on the target Windows host that has MOVEit Automation installed, from an elevated PowerShell prompt if possible so registry and program paths are fully readable. Example: powershell -ExecutionPolicy Bypass -File .\check-moveit-automation-cve-2026-5174.ps1; it needs local read access only and prints VULNERABLE, PATCHED, or UNKNOWN.

# check-moveit-automation-cve-2026-5174.ps1

# Detect likely vulnerability status for Progress MOVEit Automation on Windows.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    foreach ($p in $paths) {
        Get-ItemProperty $p | Where-Object { $_.DisplayName -match 'MOVEit Automation' }
    }
}

function To-Version($s) {
    if ([string]::IsNullOrWhiteSpace($s)) { return $null }
    $clean = ($s -replace '[^0-9\.]','').Trim('.')
    try { return [version]$clean } catch { return $null }
}

function Test-VulnerableVersion($v) {
    if ($null -eq $v) { return $null }

    $v2024_0_0 = [version]'2024.0.0'
    $v2024_1_8 = [version]'2024.1.8'
    $v2025_0_0 = [version]'2025.0.0'
    $v2025_0_9 = [version]'2025.0.9'
    $v2025_1_0 = [version]'2025.1.0'
    $v2025_1_5 = [version]'2025.1.5'

    if ($v -lt $v2024_0_0) { return $true }
    if ($v -ge $v2024_0_0 -and $v -lt $v2024_1_8) { return $true }
    if ($v -ge $v2025_0_0 -and $v -lt $v2025_0_9) { return $true }
    if ($v -ge $v2025_1_0 -and $v -lt $v2025_1_5) { return $true }

    return $false
}

$entries = @(Get-UninstallEntries)
if (-not $entries -or $entries.Count -eq 0) {
    Write-Output 'UNKNOWN - MOVEit Automation uninstall entry not found'
    exit 2
}

$found = $false
foreach ($entry in $entries) {
    $displayName = $entry.DisplayName
    $displayVersion = $entry.DisplayVersion
    $version = To-Version $displayVersion

    if ($null -eq $version) {
        Write-Output ("UNKNOWN - Found '{0}' but could not parse version '{1}'" -f $displayName, $displayVersion)
        continue
    }

    $found = $true
    $isVuln = Test-VulnerableVersion $version

    if ($isVuln -eq $true) {
        Write-Output ("VULNERABLE - {0} version {1} matches CVE-2026-5174 affected ranges" -f $displayName, $version)
        exit 1
    }
    elseif ($isVuln -eq $false) {
        Write-Output ("PATCHED - {0} version {1} is outside known CVE-2026-5174 affected ranges" -f $displayName, $version)
        exit 0
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN - MOVEit Automation found, but no parseable version detected'
    exit 2
}

Write-Output 'UNKNOWN - Detection completed without a definitive result'
exit 2

Sources

1. NVD CVE-2026-5174
2. Progress MOVEit Automation April 2026 security bulletin
3. OpenCVE record with CNA credits and CISA ADP SSVC
4. Censys advisory on MOVEit Automation auth bypass and companion CVE-2026-5174
5. runZero guidance for finding MOVEit Automation assets
6. BleepingComputer coverage of MOVEit Automation flaws and Shodan exposure claims
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS documentation and API reference