High severity · published Jul 27, 2026
CVE-2026-59690
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ECS Connection Manager · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor, NVD
LO
LoadMaster · Progress Software
7.0.6 before 7.2.63.3; 7.0.6 before 7.2.54.19 · source: vendor, NVD
MW
MOVEit WAF · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor
MT
Multi Tenant · Progress Software
7.1.29 before 7.1.35.16 · source: vendor
OS
Object Scale Connection Manager · Progress Software
7.2.60.0 before 7.2.63.3 · source: vendor
CM
Connection Manager For Objectscale · Progress
before 7.2.63.3 · source: NVD
MW
Moveit Web Application Firewall · Progress
before 7.2.63.3 · source: NVD
ML
Multi-tenant Loadmaster · Progress
before 7.1.35.16 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-481: Progress Software Kemp LoadMaster access Missing Authorization Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-59690.
Jul 29, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59690
Vendor Advisory
https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690
More from ECS Connection Manager
8.4
CVE-2026-59688
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
8.4
CVE-2026-59687
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
8.4
CVE-2026-59686
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
8.0
CVE-2026-59689
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root