CVE-2026-8488
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Progress Software MOVEit Automation has a resource allocation vulnerability without limits or throttling, leading to excessive allocation. This affects versions before 2025.0.11 and from 2025.1.0 before 2025.1.7.
Risk Assessment
The risk is that an attacker could exhaust system resources, potentially causing a denial of service (DoS).
Recommendation
Update MOVEit Automation to version 2025.0.11 or later (for the 2025.0 branch) and to 2025.1.7 or later (for the 2025.1 branch).
Other vulnerabilities in MOVEit Automation
See all- CVE-2026-4670Critical
CVE-2026-4670 vulnerability in MOVEit Automation allows for authentication bypass. This affects versions from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, and versions prior to 2024.0.0.
- CVE-2026-8487Medium
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
- CVE-2026-8486Medium
Resource allocation without limits or throttling vulnerability in Progress Software MOVEit Automation allows flooding attacks. Affects versions before 2025.0.11 and from 2025.1.0 before 2025.1.7.
- CVE-2026-8485Medium
Uncontrolled memory allocation in Progress Software MOVEit Automation allows excessive allocation, potentially leading to resource exhaustion.
Original NVD description (English source)
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS