CVE-2026-59686: progress software ecs connection manager OS Command Injection
Vulnerability summary
CVE-2026-59686 is a high (CVSS 8.4) OS Command Injection vulnerability in progress software ecs connection manager. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.
Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.4HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
+0.26 pp
From 1.41% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Progress4 products
- connection_manager_for_objectscale< 7.2.63.3
- ecs_connection_manager< 7.2.63.3
- loadmaster< 7.2.54.19 | ≥ 7.2.55.0, < 7.2.63.3
- moveit_web_application_firewall< 7.2.63.3
Progress software4 products
- ecs connection manager≥ 7.2.60.0, < 7.2.63.3
- loadmaster≥ All Previous Versions, < 7.2.63.3 | ≥ All Previous Versions, < 7.2.54.19
- moveit waf≥ 7.2.60.0, < 7.2.63.3
- object scale connection manager≥ 7.2.60.0, < 7.2.63.3
2 vendors · 8 products
References
1 links- community.progress.com/s/…Vendor Advisory