QSearchQSearch

CVE-2026-8488

4.3 MEDIUM

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation

Published: 2026-05-20 · Last updated: 2026-05-21

Severity and scoring

CVSS
4.3 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE
CWE-770

Affected products

VendorProduct
progressmoveit_automation

Description

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-7313 — CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote a... (8.7 HIGH)
  • CVE-2026-7312 — CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 t... (10.0 CRITICAL)
  • CVE-2026-7201 — CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 1... (8.8 HIGH)
  • CVE-2026-7198 — CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attack... (9.8 CRITICAL)
  • CVE-2026-7195 — CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15... (8.8 HIGH)

Same CWE

  • CVE-2026-53460 — ImageMagick is free and open-source software used for editing and manipulating digital images (7.5 HIGH)
  • CVE-2026-46702 — Russh is a Rust SSH client & server library (7.5 HIGH)
  • CVE-2026-46673 — Russh is a Rust SSH client & server library (7.5 HIGH)
  • CVE-2026-45031 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.3 MEDIUM)
  • CVE-2026-10740 — Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a... (5.3 MEDIUM)