CVE-2026-59690: progress software ecs connection manager Missing Authorization
Vulnerability summary
CVE-2026-59690 is a high (CVSS 8.0) Missing Authorization vulnerability in progress software ecs connection manager. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.
Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.0HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.03 pp
From 0.22% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Progress5 products
- connection_manager_for_objectscale< 7.2.63.3
- ecs_connection_manager< 7.2.63.3
- loadmaster< 7.2.54.19 | ≥ 7.2.55.0, < 7.2.63.3
- moveit_web_application_firewall< 7.2.63.3
- multi-tenant_loadmaster< 7.1.35.16
Progress software5 products
- ecs connection manager≥ 7.2.60.0, < 7.2.63.3
- loadmaster≥ 7.0.6, < 7.2.63.3 | ≥ 7.0.6, < 7.2.54.19
- moveit waf≥ 7.2.60.0, < 7.2.63.3
- multi tenant≥ 7.1.29, < 7.1.35.16
- object scale connection manager≥ 7.2.60.0, < 7.2.63.3
2 vendors · 10 products
References
1 links- community.progress.com/s/…Vendor Advisory