CVE-2026-8485: MOVEit Automation Memory Vulnerability

CVE-2026-8485 Overview

CVE-2026-8485 is an uncontrolled memory allocation vulnerability [CWE-789] in Progress Software MOVEit Automation. The flaw allows unauthenticated remote attackers to trigger excessive memory allocation, leading to a denial of service condition on affected servers. The vulnerability impacts MOVEit Automation versions before 2025.0.11 and versions from 2025.1.0 before 2025.1.7. Progress Software addressed the issue in subsequent patch releases documented in the vendor release notes.

Critical Impact

Unauthenticated network attackers can exhaust server memory resources, causing MOVEit Automation services to become unresponsive and disrupting file transfer automation workflows.

Affected Products

• Progress MOVEit Automation versions before 2025.0.11
• Progress MOVEit Automation versions 2025.1.0 through 2025.1.6
• Deployments exposing MOVEit Automation network endpoints to untrusted networks

Discovery Timeline

• 2026-05-20 - CVE-2026-8485 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8485

Vulnerability Analysis

The vulnerability is classified under [CWE-789] Memory Allocation with Excessive Size Value. MOVEit Automation accepts network-supplied input that influences memory allocation decisions without enforcing an upper bound. An attacker submits crafted requests that cause the application to allocate disproportionately large memory regions. Repeated or sufficiently large requests exhaust available system memory, terminating the service or destabilizing the host.

The attack requires no authentication, no user interaction, and operates over the network. The impact is limited to availability — confidentiality and integrity are not affected. MOVEit Automation orchestrates scheduled file transfers across enterprise environments, so service disruption halts business-critical data movement pipelines.

Root Cause

The root cause is missing validation on size parameters or request payload dimensions before memory allocation. The application trusts client-supplied values when sizing internal buffers or data structures. Without enforced ceilings or rate limits, a single network client can request allocations that exceed reasonable working-set boundaries.

Attack Vector

An attacker with network reachability to the MOVEit Automation service sends crafted requests containing oversized values or payload markers. The server attempts to honor the allocation request and consumes heap memory until the process or host runs out of resources. No credentials, no prior foothold, and no social engineering are required.

No verified public proof-of-concept exploit code is available at the time of publication. Refer to the Progress Release Notes 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-8485

Indicators of Compromise

• Sudden spikes in resident memory consumption by MOVEit Automation processes without corresponding job volume increases
• Repeated service restarts or out-of-memory (OOM) terminations in Windows Event Logs
• Unusual inbound network traffic patterns toward MOVEit Automation listener ports from unfamiliar source addresses
• MOVEit Automation task queue stalls or delayed scheduled transfer executions

Detection Strategies

• Baseline normal memory utilization for MOVEit Automation processes and alert on deviations exceeding established thresholds
• Correlate process memory growth with concurrent inbound HTTP/API request volume to identify amplification patterns
• Inspect application and Windows system logs for OutOfMemoryException entries or service crash events tied to MOVEit Automation

Monitoring Recommendations

• Forward MOVEit Automation application logs and host performance counters to a centralized SIEM for cross-source correlation
• Configure synthetic transactions that validate MOVEit Automation availability and trigger alerts on response timeouts
• Monitor perimeter and internal network flows for repeated connections to MOVEit Automation ports from non-allowlisted hosts

How to Mitigate CVE-2026-8485

Immediate Actions Required

• Upgrade MOVEit Automation to version 2025.0.11 or 2025.1.7 or later as documented by Progress Software
• Restrict network access to MOVEit Automation endpoints using firewall rules and allowlists for trusted administrative sources
• Review host resource limits and configure service recovery actions to restart MOVEit Automation following abnormal termination

Patch Information

Progress Software resolved CVE-2026-8485 in MOVEit Automation 2025.0.11 and 2025.1.7. Administrators should consult the Progress Release Notes 2026 for upgrade procedures and verification steps. Apply patches during a maintenance window and validate scheduled task execution after the upgrade.

Workarounds

• Place MOVEit Automation behind a reverse proxy or web application firewall that enforces request size limits and connection rate limiting
• Segment MOVEit Automation servers into restricted network zones with deny-by-default ingress policies
• Apply operating system memory quotas or job objects to cap maximum process memory and prevent host-wide exhaustion

# Example: Restrict inbound access to MOVEit Automation using Windows Firewall
New-NetFirewallRule -DisplayName "MOVEit Automation - Allow Admin Subnet" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "MOVEit Automation - Block Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -Action Block