CVE-2026-8487

Executive Summary

CVE-2026-8487 is a high-severity vulnerability in Progress Software MOVEit Automation, a managed file transfer (MFT) solution. The flaw stems from incorrect default permissions on certain files or directories, allowing a local attacker with low privileges to retrieve embedded sensitive data (e.g., credentials, API keys, or configuration secrets). This is a local privilege escalation and information disclosure issue, not a remote exploit. The CVSS score of 6.5 reflects the high confidentiality impact but requires local access and low privileges. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released patches for versions 2025.0.11 and 2025.1.7.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct product vulnerability in Progress Software’s MOVEit Automation. Organizations using MOVEit Automation should treat this as a critical supply chain risk due to the potential for credential theft.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local – The attacker must have local access to the system.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – The attacker needs a low-privileged account.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – Sensitive data can be fully exposed.
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: Medium. While the CVSS is 6.5, the potential for credential theft and lateral movement elevates the risk in enterprise environments. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as details emerge.

Deep Dive & Mechanics

The vulnerability is rooted in CWE-276: Incorrect Default Permissions. MOVEit Automation, during installation or configuration, sets overly permissive default permissions on files or directories that contain sensitive data (e.g., configuration files, credential stores, or logs). A local attacker with a low-privileged account (e.g., a standard user or service account) can read these files to extract embedded credentials, API tokens, or other secrets.

Attack Scenario:

1. An attacker gains initial access to a MOVEit Automation server via a compromised user account, phishing, or another vulnerability.
2. The attacker enumerates the file system for files with weak permissions (e.g., world-readable or group-readable).
3. The attacker reads files such as appsettings.json, credentials.xml, or log files containing plaintext secrets.
4. The attacker uses the extracted credentials to escalate privileges, access other systems, or move laterally within the network.

Affected Components:

• MOVEit Automation versions before 2025.0.11
• MOVEit Automation versions 2025.1.0 through 2025.1.6

Vulnerable vs. Patched Code

Since no specific code snippet is provided, the following is a hypothetical example of the vulnerability.

Vulnerable Code (Incorrect Permissions):

# Installation script sets world-readable permissions on config file
chmod 644 /opt/moveit/automation/config/credentials.xml

Patched Code (Correct Permissions):

# Installation script sets restrictive permissions
chmod 600 /opt/moveit/automation/config/credentials.xml
chown moveit:moveit /opt/moveit/automation/config/credentials.xml

The patch ensures that only the MOVEit service account can read sensitive files, preventing low-privileged users from accessing them.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a vulnerable MOVEit Automation server (e.g., via SSH or RDP).
• A low-privileged user account (e.g., guest or user).

Steps:

1. Enumerate Weak Permissions:

   find /opt/moveit -type f -perm /o+r 2>/dev/null
   

2. Extract Sensitive Data:

   cat /opt/moveit/automation/config/credentials.xml
   

3. Use Extracted Credentials:
   • If database credentials are found, connect to the database.
   • If API keys are found, use them to authenticate to other services.

Example Output:

<credentials>
  <entry key="db_password" value="SuperSecret123!"/>
  <entry key="api_key" value="sk-abc123def456"/>
</credentials>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor File Access: Use auditd or Sysmon to log access to sensitive files.

   auditctl -w /opt/moveit/automation/config/ -p wa -k moveit_config
   

2. Check Permissions:

   ls -la /opt/moveit/automation/config/
   

3. Review Logs: Look for unauthorized access attempts in /var/log/audit/audit.log.

Mitigation:

• Apply the vendor patch immediately.
• Manually fix permissions on existing installations:

  chmod 600 /opt/moveit/automation/config/credentials.xml
  chown moveit:moveit /opt/moveit/automation/config/credentials.xml
  

Indicators of Compromise (IOCs)

• File Paths:
  • /opt/moveit/automation/config/credentials.xml
  • /opt/moveit/automation/config/appsettings.json
  • /opt/moveit/automation/logs/*.log
• Permissions: Files with world-readable permissions (e.g., -rw-r--r--) in the MOVEit directory.
• Processes: Unusual cat, less, or find commands targeting MOVEit directories.
• Network Connections: Outbound connections from the MOVEit server to unexpected IPs (if credentials are used for lateral movement).

Detection Engineering

YARA Rule

rule CVE_2026_8487_MOVEit_Credentials {
    meta:
        description = "Detects attempts to read MOVEit Automation credential files"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $cred_file = "credentials.xml" nocase
        $config_file = "appsettings.json" nocase
        $moveit_path = "/opt/moveit/automation" nocase
    condition:
        ($cred_file or $config_file) and $moveit_path
}

Sigma Rule

title: CVE-2026-8487 - MOVEit Automation Credential File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects local access to MOVEit Automation credential files by non-privileged users
author: Valters IT
date: 2025-04-10
logsource:
    category: file_access
    product: linux
detection:
    selection:
        TargetFilename|contains:
            - '/opt/moveit/automation/config/credentials.xml'
            - '/opt/moveit/automation/config/appsettings.json'
        User|endswith: 'guest'  # Example low-privileged user
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-8487 - MOVEit Automation Credential Exfiltration"; flow:to_server,established; content:"credentials.xml"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patches:

   • Upgrade to MOVEit Automation 2025.0.11 or 2025.1.7.
   • Download from the Progress Software support portal.

2. Manual Fix:

   • If patching is delayed, manually correct file permissions:

     find /opt/moveit/automation -type f -exec chmod 600 {} \;
     find /opt/moveit/automation -type d -exec chmod 700 {} \;
     chown -R moveit:moveit /opt/moveit/automation
     

3. Rotate Credentials:

   • Assume all credentials stored in MOVEit Automation are compromised. Rotate database passwords, API keys, and service account credentials.

4. Monitor for IOCs:

   • Deploy the YARA, Sigma, and Suricata rules above.
   • Enable audit logging on the MOVEit server.

5. Network Segmentation:

   • Isolate MOVEit Automation servers from the general user network to limit local access.

Valters IT
DevSecOps & Cyber Threat Intelligence