EUVD-2026-49185
GHSA-9x4p-3pwq-9h9m
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Adjacent network because management interfaces are typically restricted, high privileges required, scope changes to underlying OS with full impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
AnalysisAI
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execute arbitrary operating system commands via the Geo Location management interface, resulting in complete system compromise. Affected products include LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. No public exploit or active exploitation was identified at the time of analysis.
Technical ContextAI
The vulnerability resides in the Geo Location management functionality of affected Progress software appliances. The root cause is improper neutralization of special elements used in an OS command (CWE-78), allowing injection of operating system commands through unsanitized user-supplied input. The affected CPEs show the vulnerability spans multiple products from Progress Software that share this management interface. Successful exploitation can subvert the security scope, moving from the application context to the underlying operating system with full read, write, and availability impact.
RemediationAI
Vendor-released patches are available; consult the advisory at the provided URL to upgrade to the latest fixed version. If immediate patching is not possible, restrict access to the Geo Location management interface to trusted management segments only, enforce strict authentication and privilege controls for administrative accounts, and monitor for unexpected command execution on the appliance. Note that restricting interface access is a compensating control that does not eliminate the underlying injection flaw if an administrative account is compromised.
More in Ecs Connection Manager
View allOS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all
We need to produce a JSON object with all the specified fields. Let's analyze the input data: CVE ID: CVE-2026-59688 De
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Con
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Co
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today