CVE-2026-59689

8.0 highEPSS 0.3%

High (8.0) in progress. EPSS 0.3% chance of exploitation in the next 30 days.

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-07-27
Modified: 2026-08-11
Record from: the NVD, synced 2026-10-19

Affected

progress:connection_manager_for_objectscale
progress:ecs_connection_manager
progress:loadmaster
progress:moveit_web_application_firewall

References

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Check your stack JSON