CVE-2026-59689: progress software ecs connection manager Incorrect Authorization
Vulnerability summary
CVE-2026-59689 is a high (CVSS 8.0) Incorrect Authorization vulnerability in progress software ecs connection manager. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.
Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.0HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.06 pp
From 0.19% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Progress4 products
- connection_manager_for_objectscale< 7.2.63.3
- ecs_connection_manager< 7.2.63.3
- loadmaster< 7.2.54.19 | ≥ 7.2.55.0, < 7.2.63.3
- moveit_web_application_firewall< 7.2.63.3
Progress software4 products
- ecs connection manager≥ 7.2.60.0, < 7.2.63.3
- loadmaster≥ 7.2.36, < 7.2.63.3 | ≥ 7.2.36, < 7.2.54.19
- moveit waf≥ 7.2.60.0, < 7.2.63.3
- object scale connection manager≥ 7.2.60.0, < 7.2.63.3
2 vendors · 8 products
References
1 links- community.progress.com/s/…Vendor Advisory