CVE-2026-59686Disclosure(progress / connection_manager_for_objectscale)

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch progress connection_manager_for_objectscale systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

progress CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

connection_manager_for_objectscale
ecs_connection_manager
loadmaster
moveit_web_application_firewall

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 3 mentions (2026-07-28); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

progress

Products

connection_manager_for_objectscaleecs_connection_managerloadmastermoveit_web_application_firewall

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	3	Disclosure1Patch2
2026-08-14	1	Disclosure1

Full discourse4 posts

CCB Alert@CCBalert90d
Patch
Warning: #Progress #Kemp #LoadMaster patched 6 critical vulnerabilities, with 3 vulnerabilities having a CVSS score of 8.4. The vulnerabilities could lead to OS command injection #RCE and privilege escalation to root #EoP. Read https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690 and #Patch #Patch #Patch
Post summary
Progress issued a patch bulletin for six critical CVEs, highlighting OS command injection and privilege‑escalation vulnerabilities with high CVSS scores. The post directs readers to the official patch page.
02000289
7.2K followersView on X
Autumn Good@autumn_good_3573d
Disclosure
MOVEit WAF Critical Security Bulletin – July 2026 - (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690) https://community.progress.com/s/article/MOVEit-WAF-Critical-Security-Bulletin-July-2026---CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690
Post summary
The text announces a MOVEit WAF security bulletin for July 2026 that lists five CVEs, but it does not supply further technical or exploit information.
00010518
7.0K followersView on X
TECHEPAGES@techepages91d
Disclosure
Progress LoadMaster Security Advisory Five vulnerabilities (CVE-2026-59686 through CVE-2026-59690) have been disclosed in Kemp LoadMaster, ECS Connection Manager, and Connection Manager for ObjectScale. 🔵 CVE-2026-59686 – Command injection via LoadMaster management interface 🔵 CVE-2026-59687 – Command injection via Geo Location management interface 🔵 CVE-2026-59688 – Command injection via backup/restore functionality 🔵 CVE-2026-59689 – Privilege escalation to root via broken access control 🔵 CVE-2026-59690 – Missing authorization in REST API (also affects Multi-Tenant LoadMaster) Recommended Action: Upgrade immediately — LoadMaster GA to v7.2.63.37, LTSF to v7.2.54.197, ECS/ObjectScale Connection Manager to v7.2.63.37, Multi-Tenant LoadMaster to v7.1.35.167.
Post summary
Five new vulnerabilities in Kemp LoadMaster and related products are announced, with recommended version upgrades to address command injection, privilege escalation, and missing authentication issues.
0000033
35 followersView on X
kokumօtօ@__kokumoto91d
Patch
Progress Kemp LoadMasterが5件の深刻な脆弱性を修正。3件(CVE-2026-59686~59688)は高権限ユーザによるコマンドインジェクションで、2件(CVE-2026-59689~59690)は低権限ユーザによる権限昇格。修正版提供あり。 https://securityonline.info/kemp-loadmaster-vulnerabilities/
Post summary
The post announces that Progress Kemp LoadMaster has released patches for five critical vulnerabilities, including three command‑injection flaws and two privilege‑escalation issues, with a link to the vendor advisory.
00000705
7.6K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	progress	connection_manager_for_objectscale	-	-	-
App	progress	ecs_connection_manager	-	-	-
OS	progress	loadmaster	-	-	-
App	progress	moveit_web_application_firewall	-	-	-

Explore more

Back to dashboard progress CVEs connection_manager_for_objectscale vulnerabilities

What researchers are saying

CVE-2026-59686

TECHEPAGES[verified]@techepagesDisclosure

Five new vulnerabilities in Kemp LoadMaster and related products are announced, with recommended version upgrades to address command injection, privilege escalation, and missing authentication issues.

kokumօtօ[verified]@__kokumotoPatch

The post announces that Progress Kemp LoadMaster has released patches for five critical vulnerabilities, including three command‑injection flaws and two privilege‑escalation issues, with a link to the vendor advisory.

CCB Alert@CCBalertPatch

Progress issued a patch bulletin for six critical CVEs, highlighting OS command injection and privilege‑escalation vulnerabilities with high CVSS scores. The post directs readers to the official patch page.

Autumn Good@autumn_good_35Disclosure

The text announces a MOVEit WAF security bulletin for July 2026 that lists five CVEs, but it does not supply further technical or exploit information.