Vulnerability details
CVE-2026-59690
Progress Software ECS Connection ManagerProgress Software LoadMasterProgress Software MOVEit WAFProgress Software Multi TenantProgress Software Object Scale Connection Manager
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
CVSS 3.1
8.0High
Official description
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.0High | 3.1 | CVEProject cvelistV5 (CNA) (ProgressSoftware) | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Progress Software | ECS Connection Manager | 7.2.60.0 ≤ v < 7.2.63.3 | CVEProject cvelistV5 (CNA) |
| Progress Software | LoadMaster | 7.0.6 ≤ v < 7.2.63.3 | CVEProject cvelistV5 (CNA) |
| Progress Software | LoadMaster | 7.0.6 ≤ v < 7.2.54.19 | CVEProject cvelistV5 (CNA) |
| Progress Software | MOVEit WAF | 7.2.60.0 ≤ v < 7.2.63.3 | CVEProject cvelistV5 (CNA) |
| Progress Software | Multi Tenant | 7.1.29 ≤ v < 7.1.35.16 | CVEProject cvelistV5 (CNA) |
| Progress Software | Object Scale Connection Manager | 7.2.60.0 ≤ v < 7.2.63.3 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-27
- Last updated
- 2026-07-28
- State
- Published
- Assigner (CNA)
- ProgressSoftware
Exploit prediction (EPSS)
0.25%
Probability of exploitation in 30 days
17.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization