This vulnerability in MOVEit Automation arises from improper input validation (CWE-20), which can be exploited to escalate privileges within the affected system. The issue impacts versions 2024.0.0 before 2024.1.8, 2025.0.0 before 2025.0.9, and 2025.1.0 before 2025.1.5. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high impact on availability but no confidentiality or integrity impact. The vendor has not yet published an official fix or remediation level, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with some privileges to escalate their privileges further within the MOVEit Automation environment. The impact is rated high due to the potential for disruption of availability, although confidentiality and integrity are not directly affected. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Progress Software's advisories closely for updates. Until a patch is available, limit access to MOVEit Automation to trusted users and environments to reduce risk.