PT-2026-64902 · Progress · Ecs Connections Manager+3

CVE-2026-59687 · Published 2026-07-27 · Updated 2026-07-27

Mitre

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-59687

Affected Products

Ecs Connections Manager

Loadmaster

Moveit Waf

Object Scale Connection Manager

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-59687 · Security Note
• https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690 · Vendor Advisory