What’s Vulnerable › Vulnerabilities
CVE-2026-59689: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root
- Severity: high (CVSS 8.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-27 · updated 2026-08-11
- Weakness: CWE-863
Description
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
Affected products
- Progress Connection Manager For Objectscale: before 7.2.63.3 — fixed in 7.2.63.3
- Progress Software ECS Connection Manager: before 7.2.63.3 — fixed in 7.2.63.3
- Progress Software LoadMaster: before 7.2.54.19; from 7.2.55.0 before 7.2.63.3 — fixed in 7.2.54.19, 7.2.63.3
- Progress Moveit Web Application Firewall: before 7.2.63.3 — fixed in 7.2.63.3
How to fix
Upgrade to a fixed version: Progress Connection Manager For Objectscale 7.2.63.3; Progress Software ECS Connection Manager 7.2.63.3; Progress Software LoadMaster 7.2.54.19, 7.2.63.3; Progress Moveit Web Application Firewall 7.2.63.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-59689 or the next vulnerability affects your stack