CVE-2026-59687

8.4 highEPSS 1.7%

High (8.4) in progress. EPSS 1.7% chance of exploitation in the next 30 days.

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

Severity

CVSS 3.1

8.4 high

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-07-27
Modified: 2026-08-11
Record from: the NVD, synced 2026-10-19

Affected

progress:connection_manager_for_objectscale
progress:ecs_connection_manager
progress:loadmaster
progress:moveit_web_application_firewall

References

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Check your stack JSON