{"id":238950,"date":"2026-05-04T10:58:00","date_gmt":"2026-05-04T14:58:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/new-moveit-vulnerabilities-prompt-urgent-vendor-warning\/"},"modified":"2026-05-04T11:05:11","modified_gmt":"2026-05-04T15:05:11","slug":"new-moveit-vulnerabilities-prompt-urgent-vendor-warning","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/04\/new-moveit-vulnerabilities-prompt-urgent-vendor-warning\/","title":{"rendered":"New MOVEit vulnerabilities prompt urgent vendor warning"},"content":{"rendered":"

New MOVEit vulnerabilities prompt urgent vendor warning<\/a><\/p>\n

https:\/\/www.cybersecuritydive.com\/news\/moveit-vulnerabilities-authentication-bypass-privilege-escalation\/819187\/<\/a><\/p>\n

Publish Date: 2026-05-04 10:58:00<\/a><\/p>\n

Source Domain: www.cybersecuritydive.com<\/a><\/p>\n

Hackers could exploit vulnerabilities in Progress Software\u2019s MOVEit Automation tool to improperly access businesses\u2019 data, the software maker said in a recent advisory.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

Exploitation of the two flaws \u2014 an authentication-bypass vulnerability tracked as <\/span><\/span><\/span><\/span><\/span><\/span>CVE-2026-4670<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> and a privilege-escalation vulnerability tracked as <\/span><\/span><\/span><\/span><\/span><\/span>CVE-2026-5174<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> \u2014 could \u201clead to unauthorized access, administrative control, and data exposure,\u201d <\/span><\/span><\/span><\/span><\/span><\/span>according to Progress Software\u2019s advisory<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

The newly patched flaws represent serious security weaknesses in a widely used managed-file-transfer program that helps organizations transfer data between self-hosted servers, cloud platforms and third-party vendors.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

Progress Software urged customers to upgrade to the latest version of the software, which fixes both vulnerabilities.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

CVE-2026-4670 is considered a critical vulnerability, while CVE-2026-5174 carries a high severity score.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

\u201cUpgrading to a patched release, using the full installer, is the only way to remediate this issue,\u201d Progress Software said, warning that the file-transfer software will need to shut down for the upgrade.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

More than 1,440 internet-connected devices are running vulnerable versions of MOVEit Automation, including 16 associated with state and local government agencies, according to <\/span><\/span><\/span><\/span><\/span><\/span>the Shodan internet-scanning tool<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

MOVEit has been the source of major anxiety for cybersecurity experts and business leaders in the past. In 2023, a zero-day vulnerability in the software fueled <\/span><\/span><\/span><\/span><\/span><\/span>a massive hacking spree<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> that included <\/span><\/span><\/span><\/span><\/span><\/span>serious ransomware attacks<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> by the Cl0p cybercrime gang.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

New MOVEit vulnerabilities prompt urgent vendor warning https:\/\/www.cybersecuritydive.com\/news\/moveit-vulnerabilities-authentication-bypass-privilege-escalation\/819187\/ Publish Date: 2026-05-04 10:58:00 Source Domain: www.cybersecuritydive.com…<\/p>\n","protected":false},"author":1,"featured_media":238951,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imgproxy.divecdn.com\/PZU-cEiO3prxaGpboCdjs8Z5fl2DKyBtefYl1wWuscE\/g:ce\/rs:fit:770:435\/Z3M6Ly9kaXZlc2l0ZS1zdG9yYWdlL2RpdmVpbWFnZS9HZXR0eUltYWdlcy0xMTI4ODQ1MzYxLmpwZw==.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[90,57,27],"class_list":["post-238950","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cve","tag-security","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238950"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=238950"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238950\/revisions"}],"predecessor-version":[{"id":238952,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238950\/revisions\/238952"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/238951"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=238950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=238950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=238950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}