CVE-2026-5174 - Vulnerability Details - OpenCVE

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174

History

Thu, 30 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Apr 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
Title		Improper Access Control Vulnerability in Progress MOVEit Automation
Weaknesses		CWE-20
References		https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published: 2026-04-30T15:07:21.589Z

Updated: 2026-04-30T16:08:10.173Z

Reserved: 2026-03-30T17:29:05.971Z

Link: CVE-2026-5174

Vulnrichment

Updated: 2026-04-30T16:08:05.188Z

NVD

Status : Received

Published: 2026-04-30T16:16:44.330

Modified: 2026-04-30T16:16:44.330

Link: CVE-2026-5174

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5174", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-03-30T17:29:05.971Z", "datePublished": "2026-04-30T15:07:21.589Z", "dateUpdated": "2026-04-30T16:08:10.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-30T15:07:21.589Z"}, "title": "Improper Access Control Vulnerability in Progress MOVEit Automation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Progress Software", "product": "MOVEit Automation", "versions": [{"status": "affected", "version": "2025.1.0", "lessThan": "2025.1.5", "versionType": "semver"}, {"status": "affected", "version": "2025.0.0", "lessThan": "2025.0.9", "versionType": "semver"}, {"status": "affected", "version": "2024.0.0", "lessThan": "2024.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2024.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.\n\nThis issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.<p>This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8<span>, versions prior to 2024.0.0.</span></p>"}]}], "references": [{"url": "https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Airbus SecLab", "type": "finder"}, {"lang": "en", "value": "Ana\u00efs Gantet", "type": "finder"}, {"lang": "en", "value": "Delphine Gourdou", "type": "finder"}, {"lang": "en", "value": "Quentin Liddell", "type": "finder"}, {"lang": "en", "value": "Matteo Ricordeau", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-30T16:07:56.433049Z", "id": "CVE-2026-5174", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T16:08:10.173Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5174", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-03-30T17:29:05.971Z", "datePublished": "2026-04-30T15:07:21.589Z", "dateUpdated": "2026-04-30T16:08:10.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-30T15:07:21.589Z"}, "title": "Improper Access Control Vulnerability in Progress MOVEit Automation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Progress Software", "product": "MOVEit Automation", "versions": [{"status": "affected", "version": "2025.1.0", "lessThan": "2025.1.5", "versionType": "semver"}, {"status": "affected", "version": "2025.0.0", "lessThan": "2025.0.9", "versionType": "semver"}, {"status": "affected", "version": "2024.0.0", "lessThan": "2024.1.8", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2024.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.\n\nThis issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.<p>This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8<span>, versions prior to 2024.0.0.</span></p>"}]}], "references": [{"url": "https://community.progress.com/s/article/MOVEit-Automation-Critical-Security-Alert-Bulletin-April-2026-CVE-2026-4670-CVE-2026-5174", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Airbus SecLab", "type": "finder"}, {"lang": "en", "value": "Ana\u00efs Gantet", "type": "finder"}, {"lang": "en", "value": "Delphine Gourdou", "type": "finder"}, {"lang": "en", "value": "Quentin Liddell", "type": "finder"}, {"lang": "en", "value": "Matteo Ricordeau", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5174", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-30T16:07:56.433049Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-30T16:08:05.188Z"}}]}}