PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8485 Progress Software CVE debrief

CVE-2026-8485 is a medium-severity Progress MOVEit Automation issue caused by uncontrolled memory allocation, which can lead to excessive allocation and availability loss. The vulnerability was publicly recorded on 2026-05-20 and affects MOVEit Automation releases before 2025.0.11 and from 2025.1.0 before 2025.1.7. The supplied CVSS vector indicates a network-reachable issue with no privileges or user interaction required, but with high attack complexity and availability impact.

Vendor
Progress Software
Product
MOVEit Automation
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-20
Advisory published
2026-05-20
Advisory updated
2026-05-20

Who should care

Administrators and security teams responsible for Progress MOVEit Automation deployments, especially environments running versions earlier than 2025.0.11 or in the 2025.1.x line before 2025.1.7.

Technical summary

The vendor-described weakness is CWE-789 (uncontrolled memory allocation). In practical terms, affected MOVEit Automation versions may allocate excessive memory under certain conditions, creating a denial-of-service risk. The NVD CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network exposure, no authentication or user interaction requirement, and primary impact to availability.

Defensive priority

Moderate. This is not a confidentiality or integrity issue in the supplied data, but it can still disrupt service. Prioritize if MOVEit Automation is externally reachable or business-critical.

Recommended defensive actions

  • Upgrade MOVEit Automation to a fixed version: 2025.0.11 or later on the 2025.0 line, or 2025.1.7 or later on the 2025.1 line.
  • Inventory all MOVEit Automation deployments to confirm whether any affected versions are present.
  • Use the Progress release notes reference to verify the fixed-issues guidance for your exact release track.
  • Treat unexpected resource exhaustion or service instability in MOVEit Automation as a security signal until patched.
  • If immediate upgrade is not possible, reduce exposure of the application and monitor for abnormal memory consumption or service degradation.

Evidence notes

Affected versions and the CWE mapping are taken from the supplied NVD record metadata, which cites Progress as the source of the weakness description. The only product-specific remediation reference supplied is Progress's fixed-issues release notes page. No KEV entry was supplied for this CVE.

Official resources

Publicly disclosed in the supplied records on 2026-05-20 (published and modified the same day in the provided timeline). The vendor reference points to Progress release notes for fixed issues; no CISA KEV listing was supplied.