CVE-2026-59688
HighCVSS 8.4Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the backup restore functionality, potentially leading to full system compromise.
Risk Assessment
Risk of full device takeover by an attacker with administrative privileges, potentially enabling further network attacks.
Recommendation
Apply security patches provided by Progress Software for all affected products.
Other vulnerabilities in Progress Software LoadMaster
See all- CVE-2026-59690High
Missing authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API, potentially leading to system compromise.
- CVE-2026-59689High
Incorrect authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate to root on the vulnerable appliance, potentially leading to full system compromise.
- CVE-2026-59687High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the Geo Location management interface, potentially leading to full system compromise.
- CVE-2026-59686High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the management interface, potentially leading to full system compromise.
Original NVD description (English source)
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.