# CVE-2026-59686: Progress Software LoadMaster OS command injection in management interface

Source: https://junglewise.ai/threats/cve-2026-59686-progress-software-loadmaster-os-command-injection-in-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-59686 · Severity: high · CVSS 8.4 · Published 2026-07-27

Progress Software has identified a security flaw in several of its networking and data management appliances, including LoadMaster and MOVEit WAF. These devices are typically used to manage web traffic and secure data transfers. An attacker with administrative access to the management interface could exploit this vulnerability to take full control of the device, potentially leading to data theft or a complete shutdown of the services the appliance supports.

Vendors: [Progress Software Corporation](https://junglewise.ai/threats/vendors/progress-software-corporation).

## Quick answers

**Is CVE-2026-59686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59686 being exploited in the wild.

**How severe is CVE-2026-59686?** High severity, with a CVSS score of 8.4, published 27 July 2026.

**Which products and versions are affected?** Progress Software Corporation MOVEit WAF 7.2.60.0 - 7.2.63.2.

**Is there a fix for CVE-2026-59686?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59686 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-59686?** Check whether you run Progress Software Corporation MOVEit WAF or Progress Software Corporation ObjectScale Connection Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS Command Injection vulnerability (CWE-78) exists in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. The flaw is located within the management interface and can be triggered by an authenticated attacker with high privileges. By sending specially crafted input to the management interface, the attacker can bypass input validation to execute arbitrary operating system commands with the privileges of the application. This can lead to a complete system compromise. The vulnerability is addressed in versions 7.2.63.3 and 7.2.54.19.

## Affected products

- Progress Software Corporation LoadMaster < 7.2.63.3, < 7.2.54.19
- Progress Software Corporation ECS Connection Manager 7.2.60.0 - 7.2.63.2
- Progress Software Corporation Object Scale Connection Manager 7.2.60.0 - 7.2.63.2
- Progress Software Corporation MOVEit WAF 7.2.60.0 - 7.2.63.2

## Timeline

- 2026-07-27: advisory: Initial publication of the security bulletin by Progress Software.
- 2026-07-27: disclosed

## References

- [https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690](https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690)