CVE-2026-4670 is an authentication bypass vulnerability classified under CWE-305 in Progress Software MOVEit Automation. It affects versions starting from 2024.0.0 up to but not including 2024.1.8, and versions from 2025.0.0 up to but not including 2025.0.9. The vulnerability allows attackers to bypass authentication mechanisms, which can lead to unauthorized access. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet published a remediation or patch, and the product is not a cloud service, so remediation depends on vendor updates. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls in MOVEit Automation, potentially gaining unauthorized access to the system. This can lead to complete compromise of sensitive data, unauthorized actions, and disruption of service. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, organizations should monitor Progress Software advisories closely for updates. Until a patch is available, consider restricting network access to MOVEit Automation instances and applying compensating controls where possible.