The following issues were fixed in MOVEit Automation 2026.0.4.

ID

Category

Fixed Issue

93936

Security, Web Admin

Web Admin responses include correctly configured Content-Security-Policy, Cache-Control, and X-Content-Type-Options HTTP headers.

94887

Security

HTTPS responses include cache-control headers that prevent sensitive web content from being stored in browser and proxy caches.

104783

Security

XML parsing in the Java API uses secure processing settings that prevent external entity and DTD processing.

104787

Security

Improved handling of large socket responses in the Java API.

105098

Security

MySQL installation security has been hardened.

105679

Security

Per-user session limits are enforced consistently.

105771

Config Utility

The Config Utility displays only certificates that are accessible to the MOVEit Automation service.

106498

API, Server

Filename sanitization has been improved to provide stronger validation of uploaded files.

107318

Tasks

Filename sanitization has been enhanced to strengthen file handling security.

107505

SMTP

SMTP host connection tests now handle email authorization errors and return the correct test result.

108078

UNC

Secure file deletion now correctly deletes files stored on UNC paths.

108091, 108092

Google Cloud Storage

Uploads to Google Cloud Storage that are set up to resume when interrupted now resume correctly.

108235

Google Cloud Storage, OneDrive

Google Cloud Storage and OneDrive transfers now apply refreshed OAuth authorization after an authentication error, allowing retries to use the new token instead of failing to continue the transfer.

108295

Installer

Upgrades no longer encounter an MC_ERROR_DISABLED error when FIPS files are locked.

108330

Security

OIDC security protections have been strengthened.

108500

SharePoint

SharePoint transfers remain active on slow connections when multiple scheduled tasks run concurrently.

108658

Database, Tamper check

Tamper checks now handle failures of specific inserts into the audit table correctly.

108661

Database

Audit table inserts now succeed for configurations containing many Global Parameters.

109145

Web Admin

Unused pages have been removed from the user interface.

109158

SFTP

SFTP connections configured with a SOCKS5 proxy now perform hostname resolution through the proxy server.

106412, 107778, 108773, 109190, 109191

Security

Multiple third-party components used by MOVEit Automation have been updated to newer supported versions, including OpenJDK, Spring, 7-Zip, Oracle MySQL Server, Apache Tomcat. These updates improve overall security and prevent potential vulnerabilities.