CVE-2026-59686
What it is
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
At a glance
- Exploitability
- Can be exploited from the same network segment with an admin-level account. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 1.7% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 1.7% · EPSS, next 30 days
- Weakness
- CWE-78 · OS command injection
- Record status
- Analyzed
Affected
- Progress Connection Manager For Objectscale < 7.2.63.3
- Progress Ecs Connection Manager < 7.2.63.3
- Progress Moveit Web Application Firewall < 7.2.63.3
- Progress Loadmaster < 7.2.54.19
- Progress Loadmaster < 7.2.63.3
Attack profile CVSS 3.1 · 8.4
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
