MOVEit WAF Critical Alert: Multi-Level RCE and WAF Bypass Vulnerabilities Disclosed

Progress Software published a critical April 2026 security advisory describing five high-impact flaws in MOVEit WAF and related ADC products, including four Remote Code Execution vulnerabilities (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048) arising from unsanitized input in administrative functions and a severe WAF bypass (CVE-2026-21876) due to multipart header validation logic; the vendor advises immediate upgrade to MOVEit WAF v7.2.63.0 and provides firmware and checksum files via the customer portal.