TL;DR: Progress Software's April 30, 2026 disclosure of CVE-2026-4670 (CVSS 9.8 authentication bypass) and CVE-2026-5174 (CVSS 7.7 privilege escalation) in MOVEit Automation, the enterprise file-transfer orchestration platform, matters to any business whose vendors run it. Chained, the pair could let an unauthenticated attacker escalate privileges. NC SMBs rarely run MOVEit Automation directly, but many NC SMBs receive files from vendors, payroll providers, banks, insurance carriers, or professional services firms that do. This is why managed file transfer (MFT) sits at the top of every SMB's fourth-party risk list in 2026, and what NC SMBs should do about it this week.
Key takeaway: MOVEit is part of a three-year pattern of MFT platforms becoming mass-exploitation targets. Per CISA advisory AA23-158A, the CL0P ransomware gang exploited zero-day vulnerabilities in GoAnywhere MFT in early 2023 and in MOVEit Transfer from May 2023, and CISA's Known Exploited Vulnerabilities catalog marks Cleo (2024) and GoAnywhere (2025) flaws as known to be used in ransomware campaigns. NC SMBs must treat MFT vendor exposure as an operational risk equal to their own perimeter.
Do you receive or send files through MOVEit, GoAnywhere, Cleo, IBM Sterling, or similar MFT platforms - or want a vendor-risk hunt across your file-transfer estate? Contact Preferred Data Corporation - BBB A+ rated, 37+ years of NC IT expertise, on-site within 200 miles of High Point. Call (336) 886-3282.
What Are CVE-2026-4670 and CVE-2026-5174?
Progress Software disclosed two vulnerabilities in MOVEit Automation, its SFTP/HTTPS-based file transfer orchestration platform, on April 30, 2026, per the NVD entries for CVE-2026-4670 and CVE-2026-5174.
- CVE-2026-4670 - CVSS 9.8 (Critical). Authentication bypass. Progress's CVSS vector rates it as exploitable over the network with no credentials and no user interaction.
- CVE-2026-5174 - CVSS 7.7 (High), per Progress. Improper input validation that allows privilege escalation by an attacker who already has low-level access.
Chained together, the first flaw could supply the low-level access the second one needs.
Remediation requires upgrading to MOVEit Automation 2025.1.5, 2025.0.9, or 2024.1.8 using the full installer. The system must go down during the upgrade; no in-place patch is available.
Why Should NC SMBs Care If They Do Not Run MOVEit?
Managed file transfer is a vendor-integration platform. NC SMBs consume MFT through their vendors even when they never license or install it themselves. The exposure paths are direct.
| Vendor Category | MFT Exposure | NC SMB Impact |
|---|---|---|
| Payroll processor | 90%+ of large payroll providers use MFT for bank + tax files | W-2, direct deposit ACH, employee PII exposure |
| Bank / lockbox | Business banking uses MFT for BAI file exchange | Cash-flow reporting, wire history |
| Insurance carrier | Group health and P&C use MFT for enrollment and claims | Employee PHI, claim history |
| Accounting / audit firm | Tax packages exchange via MFT | Business financials, K-1 data |
| Retirement plan admin | 401(k) contribution files via MFT | Contribution amounts, deferrals, employee census |
| Vendor / distributor EDI | EDI often runs over MFT | Purchase orders, invoices, pricing |
| Government reporting | State DOR, federal agencies use MFT | Tax return data, license filings |
Key takeaway: Your MFT vendor risk is a function of your ecosystem, not your own tech stack. NC manufacturers, construction firms, medical practices, and community banks are all downstream of at least 3-5 MFT-using vendors on any given month.
How Should NC SMBs Assess and Reduce Their MFT Exposure?
A five-step assessment executable within one business week for a NC SMB IT team plus MSP support.
Step 1: Inventory your MFT dependencies.
- List every recurring inbound and outbound file exchange with a vendor: payroll, bank, insurance, accounting, EDI, government, benefits. For each, note frequency, sensitivity, and vendor.
- Ask each vendor which MFT platform they use for the exchange. Common: MOVEit, GoAnywhere, Cleo Harmony, IBM Sterling B2B Integrator, Progress WS_FTP, Axway SecureTransport, and OpenText SFTPPlus.
Step 2: Rate the exposure.
- High: any exchange containing PII, PHI, financial account numbers, wire instructions, tax IDs, or authentication material.
- Medium: purchase orders, invoices, non-sensitive EDI, order confirmations.
- Low: aggregate reports, marketing lists, public-domain reference data.
Step 3: Request vendor attestation.
- Send each high-exposure vendor a one-page attestation request: (a) MFT platform and version, (b) patch status against MOVEit CVE-2026-4670/5174 and equivalent for their platform, (c) whether MFT is exposed to the public internet or behind a private allowlist, (d) SOC-2 or ISO 27001 status, (e) breach notification commitments.
- A vendor who cannot answer these five questions inside 5 business days is a supply-chain risk, not a partner.
Step 4: Deploy compensating controls on your side.
- Enforce inbound-file scanning through your email or SIEM before any received file lands in a productive system. Do not open received CSV/XML/TXT files directly into ERP or accounting; land them in a quarantine and validate first.
- Rotate any credentials shared with the vendor (SFTP passwords, API keys) on a 90-day cadence.
- Use unique folder/account credentials per vendor, not a shared "corporate" MFT account.
Step 5: Update your incident-response plan.
- Add MFT vendor breach to your IR playbook. When a vendor discloses an MFT breach, your first action is not "wait for details" - it is (a) rotate credentials shared with that vendor, (b) inventory what data flowed to that vendor in the last 90-180 days, (c) prepare data-subject notification if PII/PHI was in flight, and (d) audit your inbound file receipts for the same window for injected malicious content.
Explore Preferred Data's cybersecurity services
What Does Preferred Data Recommend NC SMBs Do This Week?
Three concrete actions before end of the business week:
- Send vendor attestation letters to your top 5 file-exchange vendors (payroll, bank, insurance, accounting, largest EDI vendor). Use the five-question format above.
- Enable file-quarantine on inbound MFT - especially payroll and bank BAI files - and require manual validation before push into ERP or accounting.
- Confirm your own file-transfer perimeter. If you host any SFTP, FTPS, HTTPS-upload, or MFT platform yourself - even a single legacy WS_FTP for a construction blueprint exchange - verify it is patched, MFA-protected, and not directly internet-exposed.
Which NC Sectors Have the Highest MFT Exposure?
Every sector uses MFT, but the concentration varies.
Financial Services (community banks, credit unions, insurance agencies):
- MFT is the backbone of ACH, BAI file exchange, and regulatory reporting. Every financial institution should treat MFT vendor risk as material.
- The GLBA Safeguards Rule requires covered financial institutions to oversee service providers, including periodically assessing them based on the risk they present.
Healthcare (medical practices, DME suppliers, rural hospitals):
- MFT handles HL7, claims 837/835, imaging DICOM, and lab result exchange. High PHI concentration.
Manufacturing (furniture, textile, automotive supplier, food processing):
- MFT handles EDI 810 (invoice), 850 (purchase order), 856 (ASN), 867 (product transfer), and OEM-supplier exchanges. High business-continuity impact if disrupted.
Construction (general contractors, subcontractors, engineering firms):
- MFT handles CAD/BIM exchanges, submittals, RFIs, and lien waivers. Lower PII but high IP concentration.
Explore Preferred Data's managed IT services
How Does Preferred Data Support NC SMBs on MFT Vendor Risk?
Preferred Data Corporation delivers vendor-risk assessment, MFT inventory, attestation letter templates, compensating-control deployment, incident-response playbook updates, and ongoing 24/7 SOC monitoring for NC manufacturers, healthcare providers, insurance agencies, financial institutions, and professional services firms. With 37+ years of NC IT expertise and an average client retention of 20+ years, our vendor-risk program integrates with your existing procurement, legal, and IT operations.
For NC SMBs within 200 miles of High Point, on-site vendor-risk workshops are available. Remote workshops and continuous SOC monitoring cover NC SMBs beyond that radius.
Frequently Asked Questions
Are we in scope even if we do not touch MOVEit?
Yes. Your exposure is your vendors' MFT posture, not your own. If your payroll processor, bank, insurance carrier, or accountant uses MOVEit and got compromised, you are downstream regardless of your own tech stack.
What is the difference between MOVEit Transfer and MOVEit Automation?
MOVEit Transfer is the file-transfer server (SFTP/HTTPS/AS2 endpoints). MOVEit Automation is the orchestration platform that schedules and runs transfer tasks between systems. CVE-2026-4670/5174 apply to Automation. Some organizations run both.
How do we know if our vendor patched?
Ask them in writing. Any responsible vendor can produce an advisory response stating patch status and remediation date within 5 business days. A vendor who cannot or will not answer is a vendor-risk indicator.
What if we host our own SFTP server?
The MOVEit CVE does not apply directly, but the same threat model does. Ensure your SFTP is behind MFA, not directly internet-exposed, patched to current, credentials rotated on a 90-day cadence, and logs sent to a SIEM. Any file received should be quarantined and scanned before promotion.
Should we drop vendors who use MOVEit?
Not automatically. MOVEit itself is not the problem - unpatched, exposed MOVEit is. A vendor who has patched to 2025.1.5+ and has MOVEit behind a private allowlist is often more secure than a smaller vendor running a homegrown SFTP. What matters is patch discipline, exposure posture, and breach notification commitments.
How much does an MFT vendor-risk program cost?
For a typical NC SMB (25-250 employees, 5-15 file-exchange vendors), the initial assessment is a fixed-fee engagement. Ongoing monitoring is folded into standard managed IT service pricing. Call (336) 886-3282 for scoping.
What if a vendor breach exposes our data?
Under NC's Identity Theft Protection Act, HIPAA breach notification, GLBA Safeguards, or your specific contractual data-processing agreement, you may have notification obligations to affected NC residents and/or regulators. Preferred Data supports incident response and notification workflow through our 24/7 SOC.