PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8485 Progress Software CVE debrief

CVE-2026-8485 is a medium-severity Progress MOVEit Automation issue caused by uncontrolled memory allocation, which can lead to excessive allocation and availability loss. The vulnerability was publicly recorded on 2026-05-20 and affects MOVEit Automation releases before 2025.0.11 and from 2025.1.0 before 2025.1.7. The supplied CVSS vector indicates a network-reachable issue with no privileges or user interaction required, but with high attack complexity and availability impact.

Vendor
Progress Software
Product
MOVEit Automation
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-23
Advisory published
2026-05-20
Advisory updated
2026-07-23

Who should care

Administrators and security teams responsible for Progress MOVEit Automation deployments, especially environments running versions earlier than 2025.0.11 or in the 2025.1.x line before 2025.1.7.

Technical summary

The vendor-described weakness is CWE-789 (uncontrolled memory allocation). In practical terms, affected MOVEit Automation versions may allocate excessive memory under certain conditions, creating a denial-of-service risk. The NVD CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network exposure, no authentication or user interaction requirement, and primary impact to availability.

Defensive priority

Moderate. This is not a confidentiality or integrity issue in the supplied data, but it can still disrupt service. Prioritize if MOVEit Automation is externally reachable or business-critical.

Recommended defensive actions

  • Upgrade MOVEit Automation to a fixed version: 2025.0.11 or later on the 2025.0 line, or 2025.1.7 or later on the 2025.1 line.
  • Inventory all MOVEit Automation deployments to confirm whether any affected versions are present.
  • Use the Progress release notes reference to verify the fixed-issues guidance for your exact release track.
  • Treat unexpected resource exhaustion or service instability in MOVEit Automation as a security signal until patched.
  • If immediate upgrade is not possible, reduce exposure of the application and monitor for abnormal memory consumption or service degradation.

Evidence notes

Affected versions and the CWE mapping are taken from the supplied NVD record metadata, which cites Progress as the source of the weakness description. The only product-specific remediation reference supplied is Progress's fixed-issues release notes page. No KEV entry was supplied for this CVE.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8485 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8485

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8485 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8485

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.