EUVD-2026-49187
GHSA-xm37-wf3w-9rh5
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (ProgressSoftware) · only source for this CVE.
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
AnalysisAI
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated low-privilege attacker to fully compromise the affected appliance. Exploitation requires network adjacency to the management interface and low-privileged credentials, with no user interaction. No public exploit is identified, and there is no evidence of active exploitation at the time of analysis.
More in Ecs Connection Manager
View allOS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all
We need to produce a JSON object with all the specified fields. Let's analyze the input data: CVE ID: CVE-2026-59688 De
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execut
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Con
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today