EUVD-2026-49188
GHSA-68jj-c942-f24v
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (ProgressSoftware) · only source for this CVE.
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
3DescriptionCVE.org
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
AnalysisAI
Privilege escalation via Missing Authorization in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows authenticated low-privileged users to perform unrestricted administrative operations through the REST API, potentially leading to full system compromise. The vulnerability is caused by improper access controls on API endpoints. A vendor advisory has been published, but no public exploit or active exploitation is reported at this time.
More in Ecs Connection Manager
View allOS command injection in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all
We need to produce a JSON object with all the specified fields. Let's analyze the input data: CVE ID: CVE-2026-59688 De
OS command injection in Progress LoadMaster and related products allows authenticated high-privilege attackers to execut
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Privilege escalation to root via incorrect authorization in Progress LoadMaster, ECS Connection Manager, Object Scale Co
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today