Progress Warns of Critical MOVEit Automation Auth Bypass Flaw

Why It Matters

An unauthenticated bypass in a widely used managed‑file‑transfer platform could let attackers hijack critical data pipelines, exposing enterprises and government agencies to data theft or ransomware extortion.

Key Takeaways

• MOVEit Automation auth bypass (CVE‑2026‑4670) affects pre‑2025.1.5 versions
• Exploit requires no credentials, low complexity, no user interaction
• Over 1,400 instances exposed; dozen linked to U.S. government
• Progress released patches for CVE‑2026‑4670 and CVE‑2026‑5174
• Unpatched MFT platforms remain prime ransomware targets

Pulse Analysis

The newly disclosed authentication‑bypass vulnerability (CVE‑2026‑4670) in Progress’s MOVEit Automation underscores the fragility of enterprise‑grade managed file transfer (MFT) solutions. Affected versions—any release earlier than 2025.1.5, 2025.0.9 or 2024.1.8—allow threat actors to gain full system access without any credentials or user interaction. Because MOVEit Automation orchestrates data flows across on‑premises servers, cloud storage and external partners, a successful exploit could compromise confidential files, disrupt business processes, and provide a foothold for further lateral movement. Progress advises customers to apply the full installer patch immediately, accepting a brief service outage as the price for restored security.

MFT platforms have become a magnet for ransomware groups, a trend highlighted by the 2023 Clop attacks on MOVEit Transfer that exposed over 2,100 organizations and 62 million individuals. The same tactics—exploiting zero‑day flaws to exfiltrate data before encrypting it—have been observed against Accellion FTA, SolarWinds Serv‑U, Gladinet CentreStack, GoAnywhere MFT and Cleo. The recent Shodan scan revealing more than 1,400 exposed MOVEit Automation instances, including several belonging to U.S. state and local governments, illustrates how widely deployed these tools are and how attractive they remain to cybercriminals seeking high‑value data pipelines.

For enterprises, the immediate priority is rapid patch deployment and verification that all MOVEit Automation nodes run the patched releases. Organizations should also conduct continuous asset discovery to identify hidden MFT instances, enforce strict network segmentation, and implement multi‑factor authentication for any administrative access. Monitoring for anomalous file‑transfer activity and integrating threat‑intelligence feeds can help detect exploitation attempts early. As the MFT market expands, vendors and customers alike must adopt a zero‑trust posture to mitigate the persistent risk of ransomware leveraging file‑transfer infrastructure.