CVE-2026-4670

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.

This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-467004.3Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that tCVE-2026-467017.6Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`procesCVE-2026-467027.5Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted cCVE-2026-467039.6Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run uCVE-2026-467055.3Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keepsCVE-2026-467084.3EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetCVE-2026-467097.8Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electronCVE-2026-46717.5justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications thatCVE-2026-467107.8Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerabilitCVE-2026-467118.3Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP servicCVE-2026-467122.3Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability wherCVE-2026-467139.2Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in th
CVE-2026-4670: Critical severity, CVSS 9.8 | Vulnix