CVE-2026-59690
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Missing authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API, potentially leading to system compromise.
Risk Assessment
Risk of privilege escalation and full compromise of the vulnerable appliance, potentially exposing the entire infrastructure to attacks.
Recommendation
Apply security patches provided by Progress Software for all affected products.
Other vulnerabilities in Progress Software LoadMaster
See all- CVE-2026-59689High
Incorrect authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate to root on the vulnerable appliance, potentially leading to full system compromise.
- CVE-2026-59688High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the backup restore functionality, potentially leading to full system compromise.
- CVE-2026-59687High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the Geo Location management interface, potentially leading to full system compromise.
- CVE-2026-59686High
An OS command injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary commands via the management interface, potentially leading to full system compromise.
Original NVD description (English source)
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.