Is CVE-2026-8487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8487 being exploited in the wild.

How severe is CVE-2026-8487?

Medium severity, with a CVSS score of 6.5, published 20 May 2026.

Which products and versions are affected?

Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7.

Is there a fix for CVE-2026-8487?

A patch was published on 2026-05-18: Release notes updated with fix information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8487 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8487?

Check whether you run Progress Software MOVEit Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8487: Progress Software MOVEit Automation incorrect default permissions

CVE-2026-8487 · Severity: medium · CVSS 6.5 · Published 2026-05-20

Progress Software MOVEit Automation is a tool used by organizations to automate complex file transfer workflows and manage data movement between systems. A security flaw in the software's default permission settings could allow an authenticated user to access sensitive data they are not authorized to see. This could lead to the exposure of confidential business information or credentials stored within the system.

Technologies: Progress Software MOVEit Automation. Vendors: Progress Software.

Quick answers

Is CVE-2026-8487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8487 being exploited in the wild.
How severe is CVE-2026-8487?: Medium severity, with a CVSS score of 6.5, published 20 May 2026.
Which products and versions are affected?: Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7.
Is there a fix for CVE-2026-8487?: A patch was published on 2026-05-18: Release notes updated with fix information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8487 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8487?: Check whether you run Progress Software MOVEit Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect default permissions vulnerability (CWE-276) exists in Progress Software MOVEit Automation. The flaw allows an attacker with low-privileged network access to retrieve embedded sensitive data due to overly permissive default access controls. The vulnerability affects versions prior to 2025.0.11 and versions in the 2025.1.x branch prior to 2025.1.7. An attacker must be authenticated to the system to exploit this issue. Progress Software has released patches to address this vulnerability in the 2026 release cycle and specific maintenance releases.

Affected products

Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7

Timeline

2026-05-20: advisory: NVD publication date
2026-05-18: patched: Release notes updated with fix information

References

https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.