CVE-2026-59688General(progress / connection_manager_for_objectscale)

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch progress connection_manager_for_objectscale systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

progress CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

connection_manager_for_objectscale
ecs_connection_manager
loadmaster
moveit_web_application_firewall

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-28); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

progress

Products

connection_manager_for_objectscaleecs_connection_managerloadmastermoveit_web_application_firewall

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

General

250.0%

Disclosure

125.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-27	1	General1
2026-07-28	2	Disclosure1Patch1
2026-08-14	1	General1

Full discourse4 posts

CCB Alert@CCBalert90d
Patch
Warning: #Progress #Kemp #LoadMaster patched 6 critical vulnerabilities, with 3 vulnerabilities having a CVSS score of 8.4. The vulnerabilities could lead to OS command injection #RCE and privilege escalation to root #EoP. Read https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690 and #Patch #Patch #Patch
Post summary
Progress/Kemp LoadMaster has released a patch bulletin covering six critical vulnerabilities, including OS command injection and privilege escalation risks, with high CVSS scores.
02000289
7.2K followersView on X
Autumn Good@autumn_good_3573d
General
MOVEit WAF Critical Security Bulletin – July 2026 - (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690) https://community.progress.com/s/article/MOVEit-WAF-Critical-Security-Bulletin-July-2026---CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690
Post summary
The text announces a critical security bulletin listing several CVEs for MOVEit WAF without providing PoCs, exploits, patches, or technical details.
00010518
7.0K followersView on X
TECHEPAGES@techepages91d
Disclosure
Progress LoadMaster Security Advisory Five vulnerabilities (CVE-2026-59686 through CVE-2026-59690) have been disclosed in Kemp LoadMaster, ECS Connection Manager, and Connection Manager for ObjectScale. 🔵 CVE-2026-59686 – Command injection via LoadMaster management interface 🔵 CVE-2026-59687 – Command injection via Geo Location management interface 🔵 CVE-2026-59688 – Command injection via backup/restore functionality 🔵 CVE-2026-59689 – Privilege escalation to root via broken access control 🔵 CVE-2026-59690 – Missing authorization in REST API (also affects Multi-Tenant LoadMaster) Recommended Action: Upgrade immediately — LoadMaster GA to v7.2.63.37, LTSF to v7.2.54.197, ECS/ObjectScale Connection Manager to v7.2.63.37, Multi-Tenant LoadMaster to v7.1.35.167.
Post summary
The advisory discloses five CVEs affecting Progress LoadMaster products, details the vulnerability mechanisms, and urges users to upgrade to specified patches to prevent potential exploitation.
0000033
35 followersView on X
VulDB 🛡@vuldb91d
General
It is possible to see elevated activities targeting Progress Software ECS Connection Manager and other products (CVE-2026-59688) https://vuldb.com/vuln/383412/cti
Post summary
The post notes possible malicious activity targeting Progress Software ECS Connection Manager linked to CVE-2026-59688, but it offers no concrete exploitation details, PoC, or patch information.
0000082
2.3K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	progress	connection_manager_for_objectscale	-	-	-
App	progress	ecs_connection_manager	-	-	-
OS	progress	loadmaster	-	-	-
App	progress	moveit_web_application_firewall	-	-	-

Explore more

Back to dashboard progress CVEs connection_manager_for_objectscale vulnerabilities

What researchers are saying

CVE-2026-59688

TECHEPAGES[verified]@techepagesDisclosure

The advisory discloses five CVEs affecting Progress LoadMaster products, details the vulnerability mechanisms, and urges users to upgrade to specified patches to prevent potential exploitation.

CCB Alert@CCBalertPatch

Progress/Kemp LoadMaster has released a patch bulletin covering six critical vulnerabilities, including OS command injection and privilege escalation risks, with high CVSS scores.

Autumn Good@autumn_good_35General

The text announces a critical security bulletin listing several CVEs for MOVEit WAF without providing PoCs, exploits, patches, or technical details.

VulDB 🛡@vuldbGeneral

The post notes possible malicious activity targeting Progress Software ECS Connection Manager linked to CVE-2026-59688, but it offers no concrete exploitation details, PoC, or patch information.