CVE-2026-59690: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-27 · updated 2026-08-11
Weakness: CWE-862

Description

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

Affected products

Progress Connection Manager For Objectscale: before 7.2.63.3 — fixed in 7.2.63.3
Progress Software ECS Connection Manager: before 7.2.63.3 — fixed in 7.2.63.3
Progress Software LoadMaster: before 7.2.54.19; from 7.2.55.0 before 7.2.63.3 — fixed in 7.2.54.19, 7.2.63.3
Progress Moveit Web Application Firewall: before 7.2.63.3 — fixed in 7.2.63.3
Progress Multi-Tenant Loadmaster: before 7.1.35.16 — fixed in 7.1.35.16

How to fix

Upgrade to a fixed version: Progress Connection Manager For Objectscale 7.2.63.3; Progress Software ECS Connection Manager 7.2.63.3; Progress Software LoadMaster 7.2.54.19, 7.2.63.3; Progress Moveit Web Application Firewall 7.2.63.3; Progress Multi-Tenant Loadmaster 7.1.35.16. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Get alerted when CVE-2026-59690 or the next vulnerability affects your stack