PT-2026-36123

CVE-2026-4670

Published

2026-04-30

Updated

2026-09-26

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOVEit Automation versions prior to 2024.1.8 MOVEit Automation versions 2024.0.0 through 2024.1.7 MOVEit Automation versions 2025.0.0 through 2025.0.8

Description An improper authentication flaw allows attackers to bypass authentication entirely. This can lead to unauthorized administrative control, data exposure, privilege escalation, and lateral movement across enterprise networks.

Recommendations Update versions prior to 2024.0.0 to version 2024.1.8 or later. Update versions 2024.0.0 through 2024.1.7 to version 2024.1.8 or later. Update versions 2025.0.0 through 2025.0.8 to version 2025.0.9 or later.

Exploitability

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-305: Authentication Bypass by Primary Weakness