CVE-2026-59690
Received Received - Intake

Missing Authorization in Progress LoadMaster and Related Products

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Progress Software Corporation

Description
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-59690
EUVD
EUVD-2026-49188

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
progress_software loadmaster *
progress_software ecs_connection_manager *
progress_software object_scale_connection_manager *
progress_software moveit_waf *
progress_software multi_tenant *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Missing Authorization vulnerability in several Progress Software products. An authenticated attacker with low privileges can perform privileged administrative operations via the REST API that should not be accessible to their permission level. This could lead to a system compromise.

Impact Analysis

An attacker could gain unauthorized access to sensitive administrative functions, potentially leading to data breaches, system manipulation, or complete system takeover. This could affect data confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, unauthorized disclosures, and failure to meet security control standards.

Mitigation Strategies

Immediately restrict access to the REST API to only trusted users and networks. Review and update user permissions to ensure low-privilege users cannot perform administrative operations. Apply patches or updates from Progress Software as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59690. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart