Cyber Resilience

CVE-2026-8485

Medium

Published: 20 May 2026

Published
20 May 2026
Modified
20 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0034 25.5th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-8485 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Progress Moveit Automation. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 25.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

CWE(s)
CWE-789

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Uncontrolled memory allocation (CWE-789) directly enables remote exploitation to exhaust resources, mapping to application/system exploitation for endpoint DoS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-8488Same product: Progress Moveit Automation
CVE-2026-4670Same product: Progress Moveit Automation
CVE-2026-8486Same product: Progress Moveit Automation
CVE-2026-5174Same product: Progress Moveit Automation
CVE-2026-8487Same product: Progress Moveit Automation
CVE-2025-11235Same product class: managed file transfer
CVE-2025-13447Same product class: managed file transfer
CVE-2025-2324Same product class: managed file transfer
CVE-2023-34362Same product class: managed file transfer
CVE-2025-13444Same product class: managed file transfer

Affected Assets

progress
moveit automation
≤ 2025.0.11 · 2025.1.0 — 2025.1.7

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References