Progress MOVEit Automation Arbitrary Code Execution | MSSP Advisory

Progress Software disclosed CVE-2026-4670, a critical vulnerability affecting multiple versions of MOVEit Automation. The flaw allows attackers to execute arbitrary code on vulnerable MOVEit Automation instances. This follows the pattern of previous MOVEit vulnerabilities that became mass exploitation targets.

MOVEit Automation sits in your client environments handling sensitive file transfers, making this a direct exposure to your advisory obligations if exploited. Your own service delivery often depends on secure file transfer protocols, and a compromised MOVEit instance at a client site becomes your reputation problem when the breach investigation starts.