Quick answers
- Is CVE-2026-8485 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8485 being exploited in the wild.
- How severe is CVE-2026-8485?
- Medium severity, with a CVSS score of 5.9, published 20 May 2026.
- Which products and versions are affected?
- Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7.
- Is there a fix for CVE-2026-8485?
- A patch was published on 2026-05-18: Release notes published for fixed versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-8485 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-8485?
- Check whether you run Progress Software MOVEit Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An uncontrolled memory allocation vulnerability (CWE-789) exists in Progress Software MOVEit Automation. The flaw allows for excessive memory allocation, which can be triggered by a remote attacker. While the attack vector is network-based and requires no authentication, the complexity is rated as high, suggesting specific conditions or configurations must be met to trigger the exhaustion. Successful exploitation results in a denial-of-service (DoS) condition by exhausting available system memory. The issue is addressed in MOVEit Automation versions 2025.0.11, 2025.1.7, and the 2026 release.
Affected products
- Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7
Timeline
- 2026-05-20: advisory: NVD publication date
- 2026-05-18: patched: Release notes published for fixed versions