Progress LoadMaster CVE-2026-59688

Requires an authenticated session with HIGH privileges (administrator) on the target appliance AND adjacent-network reachability to the management interface (CVSS AV:A) - not internet-facing remote-unauthenticated. The specific trigger is the backup restore functionality: the attacker must be able to supply or select a crafted backup whose contents inject shell metacharacters into an OS command executed by the restore process. Limiting factors: exploitation is gated behind existing admin credentials (PR:H), constrained to adjacent access rather than arbitrary remote origin, and CISA SSVC assesses it as not automatable - so it is a targeted admin-to-OS escalation, not a mass-exploitable condition. Affected: LoadMaster (7.2.40.0 up to <7.2.63.3 / <7.2.54.19), ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF (7.2.60.0 up to <7.2.63.3).

Signals converge on a real-but-not-urgent priority. The provided CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C, C:H/I:H/A:H = 8.4 HIGH) is internally consistent and honest: it correctly encodes that exploitation requires high privileges (PR:H) and adjacent - not internet-wide - network access (AV:A), which meaningfully caps exposure versus a typical 'critical' remote-unauth flaw. This is corroborated by the CISA SSVC framework, which rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (cannot be reliably weaponized at scale), while agreeing Technical Impact is 'total' (full appliance compromise). EPSS is modest at 0.72% (50th percentile), consistent with SSVC 'none' and the absence of KEV listing or any public POC. There is no conflict among the sources: high technical impact but constrained reachability (authenticated admin, adjacent network, no automation). Bottom line: patch on a normal-to-prioritized cadence for exposed appliances, but this is not a drop-everything emergency - the PR:H prerequisite means an attacker must already hold appliance admin credentials, so the vuln is primarily an admin-to-root/OS privilege and integrity escalation on the appliance rather than a mass-exploitable entry point.

An attacker who has already obtained high-privilege (administrator) access to a LoadMaster, ECS/Object Scale Connection Manager, or MOVEit WAF appliance - via stolen credentials, session hijack, or a chained authentication flaw - uploads or triggers a maliciously crafted backup and invokes the restore functionality, embedding shell metacharacters that the restore process passes to an OS command. The injected commands execute in the appliance's underlying operating system context, yielding complete system compromise. No public exploit code is identified at the time of analysis, and CISA SSVC rates exploitation as 'none'.