MW
Product
MOVEit WAF
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 0Low 0
Watch
Add MOVEit WAF to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8037 In wildKEV | 9.8 | Jun 4 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: V7.2.60.0 before V7.2.63.2 |
| CVE-2026-59688 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality Affected: 7.2.60.0 before 7.2.63.3 |
| CVE-2026-59687 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface Affected: 7.2.60.0 before 7.2.63.3 |
| CVE-2026-59686 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface Affected: 7.2.60.0 before 7.2.63.3 |
| CVE-2026-59690 | 8.0 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API Affected: 7.2.60.0 before 7.2.63.3 |
| CVE-2026-59689 | 8.0 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root Affected: 7.2.60.0 before 7.2.63.3 |
| CVE-2026-4048 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: V7.2.62.0 before V7.2.63.0 |
| CVE-2026-3519 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: V7.2.62.0 before V7.2.63.0 |
| CVE-2026-3518 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: V7.2.62.0 before V7.2.63.0 |
| CVE-2026-3517 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: 7.2.62.0 before V7.2.63.0 |
Showing 10