OS Command Injection Vulnerability in Progress Software LoadBalancers
CVE-2026-59686

8.4HIGH

Key Information:

Vendor

Progress Software
Status
Loadmaster
Ecs Connection Manager
Object Scale Connection Manager
Moveit Waf
Vendor
CVE Published:
27 July 2026

What is CVE-2026-59686?

A significant OS Command Injection vulnerability exists within various Progress Software products, including LoadMaster and MOVEit WAF. This flaw permits authenticated users with elevated privileges to run arbitrary operating system commands through the management interface. The exploitation of this vulnerability can lead to a complete system compromise, threatening the integrity and confidentiality of sensitive information on the affected appliances.

Affected Version(s)

ECS Connection Manager 7.2.60.0 < 7.2.63.3

LoadMaster All Previous Versions < 7.2.63.3

LoadMaster All Previous Versions < 7.2.54.19

References

https://community.progress.com/s/article/LoadMaster-Criti...
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.