CVE-2026-59689
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate to root on the vulnerable appliance, potentially leading to full system compromise.
Risk Assessment
Risk of full device takeover by a low-privileged attacker, potentially compromising the entire network.
Recommendation
Apply security patches provided by Progress Software for all affected products.
Other vulnerabilities in Progress Software LoadMaster
See all- CVE-2026-59690High
Missing authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API, potentially leading to system compromise.
- CVE-2026-59688High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the backup restore functionality, potentially leading to full system compromise.
- CVE-2026-59687High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the Geo Location management interface, potentially leading to full system compromise.
- CVE-2026-59686High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the management interface, potentially leading to full system compromise.
Original NVD description (English source)
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.