CVE-2026-5174 is a CWE-20 improper input validation vulnerability in Progress Software MOVEit Automation. This flaw allows an attacker with some privileges to escalate their privileges further within the affected software. The issue impacts versions from 2024.0.0 before 2024.1.8, 2025.0.0 before 2025.0.9, and 2025.1.0 before 2025.1.5. The vulnerability is rated high severity with a CVSS 3.1 score of 7.7, indicating network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with impact on availability. No vendor advisory or patch links are currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability allows privilege escalation within MOVEit Automation, potentially enabling an attacker to gain higher-level access than originally permitted. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability. This could disrupt automated workflows or services relying on MOVEit Automation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Progress Software advisories closely for updates. Until a fix is available, limit access to MOVEit Automation to trusted users and environments to reduce risk.