Loading story…
Progress Software disclosed five high-severity vulnerabilities affecting LoadMaster, ECS Connection Manager, Connection Manager for ObjectScale, MOVEit WAF, and, for one issue, Multi-Tenant LoadMaster. The flaws, tracked as CVE-2026-59686 through CVE-2026-59690, include three authenticated OS command injection bugs and two authorization failures. CVE-2026-59689 can let a low-privileged authenticated user escalate to root, while CVE-2026-59690 allows unauthorized administrative actions through the REST API; the command injection issues (CVE-2026-59686, CVE-2026-59687, and CVE-2026-59688) affect the management interface, Geo Location management interface, and backup restore functionality, respectively.
Progress said it has no reports of active exploitation, no known direct customer impact, and no indicators of compromise so far, but warned that successful exploitation could lead to full appliance compromise. The vulnerabilities carry CVSS 3.1 scores of 8.0 to 8.4, affect older product releases, and require authentication, prompting the vendor to urge immediate upgrades to fixed versions. Defenders are advised to tighten privileged account access, enforce strong authentication controls such as MFA where available, and closely monitor management interfaces and REST API activity for suspicious behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the July 27, 2026 disclosure, Progress stated it had no reports of active exploitation, no known direct customer impact, and no indicators of compromise related to the five vulnerabilities. The company urged customers to upgrade to fixed versions and strengthen administrative security and monitoring.
On 2026-07-27, Progress disclosed five vulnerabilities affecting LoadMaster, ECS Connection Manager, Connection Manager for ObjectScale, MOVEit WAF, and for one flaw Multi-Tenant LoadMaster. The issues, tracked as CVE-2026-59686 through CVE-2026-59690, include three authenticated OS command injection flaws and two authorization flaws that could enable privileged actions or root compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecommunity.progress.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
Progress Software disclosed two critical vulnerabilities in **MOVEit Automation**, including **CVE-2026-4670**, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to **CWE-305** and included it in a security bulletin covering both **CVE-2026-4670** and **CVE-2026-5174**. The advisories affect multiple MOVEit Automation release branches, including versions prior to **2025.0.9**, **2024.1.8**, and releases before **2024.0.0**, with broader vendor and government guidance also referencing affected builds such as **2025.1.4 and earlier**, **2025.0.8 and earlier**, **2024.1.7 and earlier**, and **2024.0.0 and earlier**. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Jun 29, 2026