CVE-2026-59687: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59687?
CVE-2026-59687 has a severity rating of 8.4, classified as high.
What impact does CVE-2026-59687 have on affected systems?
CVE-2026-59687 allows an authenticated attacker with high privileges to execute arbitrary operating system commands.
How can I remediate CVE-2026-59687?
To fix CVE-2026-59687, ensure that your Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF are updated to the latest security patches.
Who is affected by CVE-2026-59687?
CVE-2026-59687 affects users of Progress LoadMaster, Progress ECS Connection Manager, Progress Object Scale Connection Manager, and Progress MOVEit WAF.
What is the attack vector for CVE-2026-59687?
The attack vector for CVE-2026-59687 is through the Geo Location Management Interface, where privileged authenticated users can exploit the vulnerability.