CVE-2026-59689

Published: Jul 27, 2026Modified: Aug 11, 2026

8.0

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: security@progress.com (Secondary)

Description

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

Affected (5)

Products: Progress: Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster, Moveit Web Application Firewall

Progress

4 products

Connection Manager For Objectscale

Ecs Connection Manager

Loadmaster

Moveit Web Application Firewall

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Progress Connection Manager For Objectscale	Before 7.2.63.3
Progress Ecs Connection Manager	Before 7.2.63.3
Progress Loadmaster	Before 7.2.54.19
Progress Loadmaster	From 7.2.55.0 to 7.2.63.3
Progress Moveit Web Application Firewall	Before 7.2.63.3

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.