# CVE-2026-8488: Progress Software MOVEit Automation resource exhaustion in Server

Source: https://junglewise.ai/threats/cve-2026-8488-progress-software-moveit-automation-resource-exhaustion-in-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-8488 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Progress Software MOVEit Automation is a managed file transfer solution used to automate complex data workflows. A vulnerability in the way the system handles resource allocation allows an authenticated user to trigger excessive resource consumption. This can lead to a partial denial of service, potentially slowing down or disrupting automated file transfer operations.

Technologies: [Progress Software MOVEit Automation](https://junglewise.ai/threats/technologies/moveit-automation). Vendors: [Progress Software](https://junglewise.ai/threats/vendors/progress-software).

## Quick answers

**Is CVE-2026-8488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8488 being exploited in the wild.

**How severe is CVE-2026-8488?** Medium severity, with a CVSS score of 4.3, published 20 May 2026.

**Which products and versions are affected?** Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7.

**Is there a fix for CVE-2026-8488?** A patch was published on 2026-05-18: Fixes included in 2026 release notes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8488 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8488?** Check whether you run Progress Software MOVEit Automation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An allocation of resources without limits or throttling vulnerability (CWE-770) exists in Progress Software MOVEit Automation. The flaw allows an authenticated attacker with network access to trigger excessive resource allocation within the server component. This is a low-complexity attack that impacts the availability of the service but does not compromise data confidentiality or integrity. The issue is resolved in MOVEit Automation versions 2025.0.11, 2025.1.7, and the 2026 release.

## Affected products

- Progress Software MOVEit Automation before 2025.0.11, 2025.1.0 before 2025.1.7

## Timeline

- 2026-05-18: patched: Fixes included in 2026 release notes
- 2026-05-20: advisory: NVD publication date

## References

- [https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html](https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html)

## Related threats

- [Progress Software MOVEit Automation incorrect default permissions](https://junglewise.ai/threats/cve-2026-8487-progress-software-moveit-automation-incorrect-default-permissions)
- [Progress Software MOVEit Automation resource exhaustion via flooding](https://junglewise.ai/threats/cve-2026-8486-progress-software-moveit-automation-resource-exhaustion-via)
- [Progress Software MOVEit Automation uncontrolled memory allocation](https://junglewise.ai/threats/cve-2026-8485-progress-software-moveit-automation-uncontrolled-memory-allocation)