{"id":6641,"date":"2026-05-04T21:47:43","date_gmt":"2026-05-04T21:47:43","guid":{"rendered":"https:\/\/delimiter.online\/blog\/moveit-automation-vulnerability\/"},"modified":"2026-05-04T21:47:43","modified_gmt":"2026-05-04T21:47:43","slug":"moveit-automation-vulnerability","status":"publish","type":"post","link":"https:\/\/delimiter.online\/blog\/moveit-automation-vulnerability\/","title":{"rendered":"Progress Patches Critical MOVEit Automation Authentication Bypass Bug"},"content":{"rendered":"

Progress Software<\/a> has released security updates to address two vulnerabilities in its MOVEit Automation product, including a critical flaw that could allow attackers to bypass authentication systems.<\/p>\n

The urgent patches were issued after internal security research identified the vulnerabilities. The most severe of the two is a critical authentication bypass<\/a> bug, which could provide unauthorized access to the system.<\/p>\n

Critical Vulnerability Details<\/h2>\n

The authentication bypass vulnerability, tracked as CVE 2024 5806, carries a CVSS score of 9.1 out of 10, marking it as critical. This flaw affects the REST API endpoint in MOVEit Automation, potentially allowing an attacker to bypass authentication mechanisms entirely.<\/p>\n

When exploited, this vulnerability could give a remote, unauthenticated attacker full access to the system’s administrative functions. This level of access could allow attackers to manipulate file transfers, access sensitive data, or disrupt automated workflows.<\/p>\n

The second vulnerability, tracked as CVE 2024 5805, involves information disclosure through a different API endpoint. While less severe than the authentication bypass, this flaw could still expose sensitive system information to unauthorized parties.<\/p>\n

Affected Systems and Remediation<\/h2>\n

MOVEit Automation, formerly known as Central, is a server based managed file transfer (MFT) solution. Organizations use it to schedule and automate file movement workflows without requiring custom scripts. The software is commonly deployed in enterprise environments for secure data exchange.<\/p>\n

Progress Software has released patches for MOVEit Automation version 2024.0.2 and earlier. The company recommends that all users apply the updates immediately to protect their systems from potential exploitation.<\/p>\n

These vulnerabilities affect the MOVEit Automation product specifically and are separate from the vulnerabilities that impacted the broader MOVEit Transfer platform last year. That earlier incident caused widespread disruption and data breaches across numerous organizations globally.<\/p>\n

Industry Context and Response<\/h2>\n

The security updates come as organizations remain highly sensitive to vulnerabilities in file transfer software. The MOVEit ecosystem has been under increased scrutiny since the 2023 Clop ransomware attacks that exploited zero day vulnerabilities in MOVEit Transfer.<\/p>\n

Progress Software has stated that it is not aware of any active exploitation of these newly disclosed vulnerabilities in the wild. However, the company strongly urges users to prioritize patching given the critical severity of the authentication bypass flaw.<\/p>\n

The company also advises organizations to review their MOVEit Automation configurations and restrict API access to trusted networks where possible. Implementing additional access controls alongside the patches can help mitigate risks during the update window.<\/p>\n

Security researchers have noted that authentication bypass vulnerabilities pose an especially high risk because they can allow attackers to gain initial access without any legitimate credentials. This type of flaw often becomes a target for automated scanning and exploitation attempts after disclosure.<\/p>\n

Progress Software has not provided a specific timeline for any further updates but has indicated that security remains a priority for its product development. The company continues to invest in internal security research and vulnerability discovery processes.<\/p>\n

Organizations using MOVEit Automation should review their current version and apply the latest patches as soon as possible. Delayed patching could leave critical infrastructure exposed to potential compromise through these disclosed security gaps.<\/p>\n

Source: GeekWire<\/p>\n","protected":false},"excerpt":{"rendered":"

Progress Software has released security updates to address two vulnerabilities in its MOVEit Automation product, including a critical flaw that could allow attackers to bypass authentication systems. The urgent patches were issued after internal security research identified the vulnerabilities. The most severe of the two is a critical authentication bypass bug, which could provide unauthorized […]<\/p>\n","protected":false},"author":1,"featured_media":6642,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[505],"tags":[7466,619,7791,7792,4425],"class_list":["post-6641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-authentication-bypass","tag-cybersecurity","tag-moveit-automation","tag-progress-software","tag-vulnerability-patch"],"_links":{"self":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts\/6641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/comments?post=6641"}],"version-history":[{"count":0,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts\/6641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/media\/6642"}],"wp:attachment":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/media?parent=6641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/categories?post=6641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/tags?post=6641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}