Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities found for ECS Connection Manager by Progress Software
CVE-2026-59690 (GCVE-0-2026-59690)
Vulnerability from nvd – Published: 2026-07-27 12:26 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
Summary
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.0.6 , < 7.2.63.3
(custom)
Affected: 7.0.6 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Multi Tenant |
Affected:
7.1.29 , < 7.1.35.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:33.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.0.6",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.0.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Multi Tenant",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.1.35.16",
"status": "affected",
"version": "7.1.29",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xander Mackenzie | @thetrueartist.co.uk working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise."
}
],
"value": "A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122: Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:26:27.980Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59690",
"datePublished": "2026-07-27T12:26:27.980Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:33.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59689 (GCVE-0-2026-59689)
Vulnerability from nvd – Published: 2026-07-27 12:25 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root
Summary
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.2.36 , < 7.2.63.3
(custom)
Affected: 7.2.36 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:34.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.36",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.2.36",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xander Mackenzie | @thetrueartist.co.uk working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise."
}
],
"value": "An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:25:22.245Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59689",
"datePublished": "2026-07-27T12:25:22.245Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:34.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59688 (GCVE-0-2026-59688)
Vulnerability from nvd – Published: 2026-07-27 12:24 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.2.40.0 , < 7.2.63.3
(custom)
Affected: 7.2.40.0 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59688",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:34.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.40.0",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.2.40.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23: File Content Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:24:23.139Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59688",
"datePublished": "2026-07-27T12:24:23.139Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:34.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59687 (GCVE-0-2026-59687)
Vulnerability from nvd – Published: 2026-07-27 12:23 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.0.8 , < 7.2.63.3
(custom)
Affected: 7.0.8 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:35.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.0.8",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.0.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:23:15.683Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59687",
"datePublished": "2026-07-27T12:23:15.683Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:35.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59686 (GCVE-0-2026-59686)
Vulnerability from nvd – Published: 2026-07-27 12:22 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
All Previous Versions , < 7.2.63.3
(custom)
Affected: All Previous Versions , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:37.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "All Previous Versions",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "All Previous Versions",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:22:05.699Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59686",
"datePublished": "2026-07-27T12:22:05.699Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:37.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59690 (GCVE-0-2026-59690)
Vulnerability from cvelistv5 – Published: 2026-07-27 12:26 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
Summary
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.0.6 , < 7.2.63.3
(custom)
Affected: 7.0.6 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Multi Tenant |
Affected:
7.1.29 , < 7.1.35.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:33.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.0.6",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.0.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Multi Tenant",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.1.35.16",
"status": "affected",
"version": "7.1.29",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xander Mackenzie | @thetrueartist.co.uk working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise."
}
],
"value": "A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122: Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:26:27.980Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59690",
"datePublished": "2026-07-27T12:26:27.980Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:33.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59689 (GCVE-0-2026-59689)
Vulnerability from cvelistv5 – Published: 2026-07-27 12:25 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root
Summary
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.2.36 , < 7.2.63.3
(custom)
Affected: 7.2.36 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:34.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.36",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.2.36",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Xander Mackenzie | @thetrueartist.co.uk working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise."
}
],
"value": "An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:25:22.245Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59689",
"datePublished": "2026-07-27T12:25:22.245Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:34.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59688 (GCVE-0-2026-59688)
Vulnerability from cvelistv5 – Published: 2026-07-27 12:24 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.2.40.0 , < 7.2.63.3
(custom)
Affected: 7.2.40.0 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59688",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:34.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.40.0",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.2.40.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23: File Content Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:24:23.139Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59688",
"datePublished": "2026-07-27T12:24:23.139Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:34.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59687 (GCVE-0-2026-59687)
Vulnerability from cvelistv5 – Published: 2026-07-27 12:23 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
7.0.8 , < 7.2.63.3
(custom)
Affected: 7.0.8 , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:35.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.0.8",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "7.0.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:23:15.683Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59687",
"datePublished": "2026-07-27T12:23:15.683Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:35.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59686 (GCVE-0-2026-59686)
Vulnerability from cvelistv5 – Published: 2026-07-27 12:22 – Updated: 2026-07-28 03:55
VLAI
EPSS
VEX
Title
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
Summary
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/LoadMast… | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | LoadMaster |
Affected:
All Previous Versions , < 7.2.63.3
(custom)
Affected: All Previous Versions , < 7.2.54.19 (custom) |
|
| Progress Software | ECS Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | Object Scale Connection Manager |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
|
| Progress Software | MOVEit WAF |
Affected:
7.2.60.0 , < 7.2.63.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:55:37.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LoadMaster",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "All Previous Versions",
"versionType": "custom"
},
{
"lessThan": "7.2.54.19",
"status": "affected",
"version": "All Previous Versions",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ECS Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Object Scale Connection Manager",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MOVEit WAF",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "7.2.63.3",
"status": "affected",
"version": "7.2.60.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise."
}
],
"value": "An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T12:22:05.699Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-59686",
"datePublished": "2026-07-27T12:22:05.699Z",
"dateReserved": "2026-07-06T13:14:43.248Z",
"dateUpdated": "2026-07-28T03:55:37.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}