High severity · published Jul 27, 2026
CVE-2026-59688
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
8.4
CVSS
1.7%
EPSS
No
On KEV
Description
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ECS Connection Manager · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor, NVD
LO
LoadMaster · Progress Software
7.2.40.0 before 7.2.63.3; 7.2.40.0 before 7.2.54.19 · source: vendor, NVD
MW
MOVEit WAF · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor
OS
Object Scale Connection Manager · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor
CM
Connection Manager For Objectscale · Progress
before 7.2.63.3 · source: NVD
MW
Moveit Web Application Firewall · Progress
before 7.2.63.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59688
Vendor Advisory
https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690
More from ECS Connection Manager
8.4
CVE-2026-59687
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
8.4
CVE-2026-59686
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
8.0
CVE-2026-59690
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
8.0
CVE-2026-59689
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root