CVE-2026-59690: Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59690?
CVE-2026-59690 has a high severity rating of 8.
How do I fix CVE-2026-59690?
To mitigate CVE-2026-59690, ensure that proper authentication and authorization controls are implemented in your REST API.
What systems are affected by CVE-2026-59690?
CVE-2026-59690 affects Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant.
What type of attack does CVE-2026-59690 allow?
CVE-2026-59690 allows authenticated attackers with low privileges to escalate their privileges and perform administrative operations.
What are the potential impacts of CVE-2026-59690?
The potential impacts of CVE-2026-59690 include unauthorized access to sensitive operations and data manipulation.