CVE-2026-59687: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-27 · updated 2026-08-11
Weakness: CWE-78

Description

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

Affected products

Progress Connection Manager For Objectscale: before 7.2.63.3 — fixed in 7.2.63.3
Progress Software ECS Connection Manager: before 7.2.63.3 — fixed in 7.2.63.3
Progress Software LoadMaster: before 7.2.54.19; from 7.2.55.0 before 7.2.63.3 — fixed in 7.2.54.19, 7.2.63.3
Progress Moveit Web Application Firewall: before 7.2.63.3 — fixed in 7.2.63.3

How to fix

Upgrade to a fixed version: Progress Connection Manager For Objectscale 7.2.63.3; Progress Software ECS Connection Manager 7.2.63.3; Progress Software LoadMaster 7.2.54.19, 7.2.63.3; Progress Moveit Web Application Firewall 7.2.63.3. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Get alerted when CVE-2026-59687 or the next vulnerability affects your stack