MOVEit Automation Privilege Escalation (CVE-2026-5174)

Progress Software’s MOVEit Automation is impacted by CVE-2026-5174, an improper input validation vulnerability that allows for privilege escalation. The National Vulnerability Database (NVD) rates this issue with a high CVSS score of 7.7. This isn’t just a theoretical flaw; it’s a critical gateway for an attacker to gain elevated access within an organization’s file transfer infrastructure.

The vulnerability affects multiple versions of MOVEit Automation, specifically from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, and from 2024.0.0 before 2024.1.8, including all versions prior to 2024.0.0. The NVD highlights CWE-20 (Improper Input Validation) as the root cause, a common but often overlooked vector for privilege escalation and command injection attacks. Attackers don’t need highly sophisticated tooling for this; they just need to understand how to manipulate the input.

For defenders, this means a low-privileged attacker, or even an external actor who gains initial access, could leverage this to move laterally and establish persistence with higher privileges. The attacker’s calculus here is simple: find a weak point in input handling, exploit it to run commands as a more powerful user, and then expand their foothold. This is how minor incidents turn into major breaches.