PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8488 Progress Software CVE debrief

CVE-2026-8488 is a medium-severity availability issue in Progress Software MOVEit Automation. The published record describes an allocation-of-resources-without-limits-or-throttling weakness (CWE-770), which can lead to excessive allocation and service degradation if left unpatched. NVD lists the issue as affecting MOVEit Automation before 2025.0.11 and from 2025.1.0 before 2025.1.7.

Vendor
Progress Software
Product
MOVEit Automation
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-23
Advisory published
2026-05-20
Advisory updated
2026-07-23

Who should care

Administrators and security teams running Progress MOVEit Automation should prioritize this advisory, especially where the service is internet-facing or where availability is business-critical. The published CVSS vector indicates network access with low privileges required and an availability impact, so even non-admin users with access to the service may be relevant to risk assessment.

Technical summary

NVD records CVE-2026-8488 as a CWE-770 resource-management issue in MOVEit Automation. The official vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating network reachability, low required privileges, no user interaction, and an availability-only impact. The affected ranges cited in the record are before 2025.0.11 and 2025.1.0 through 2025.1.6.

Defensive priority

Moderate: patching is recommended because the issue can affect availability, but the published severity is medium and the impact is limited to denial-of-service style resource exhaustion rather than confidentiality or integrity loss.

Recommended defensive actions

  • Upgrade MOVEit Automation to 2025.0.11 or later if you are on the 2025.0.x line.
  • Upgrade MOVEit Automation to 2025.1.7 or later if you are on the 2025.1.x line.
  • Confirm whether your deployment falls within the affected version ranges before planning maintenance.
  • Review the vendor release notes referenced by NVD to validate the fixed build for your installation.
  • Monitor the service for unusual CPU, memory, disk, or worker-queue growth while unpatched.
  • Apply standard access controls and least-privilege practices to reduce exposure while remediation is underway.

Evidence notes

The NVD record for CVE-2026-8488 cites a Progress Software release-notes page as its reference and assigns CWE-770. The supplied source data also includes the affected-version ranges and the CVSS vector. Vendor attribution is based on the referenced Progress documentation and should be treated as confirmed only after checking the vendor advisory directly.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8488 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8488

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8488 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8488

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.