CVE-2026-59690

Published: Jul 27, 2026Modified: Aug 11, 2026

8.0

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: security@progress.com (Secondary)

Description

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

Affected (6)

Products: Progress: Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster, Moveit Web Application Firewall, Multi Tenant Loadmaster

Progress

5 products

Connection Manager For Objectscale

Ecs Connection Manager

Loadmaster

Moveit Web Application Firewall

Multi Tenant Loadmaster

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Progress Connection Manager For Objectscale	Before 7.2.63.3
Progress Ecs Connection Manager	Before 7.2.63.3
Progress Loadmaster	Before 7.2.54.19
Progress Loadmaster	From 7.2.55.0 to 7.2.63.3
Progress Moveit Web Application Firewall	Before 7.2.63.3
Progress Multi Tenant Loadmaster	Before 7.1.35.16

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.