Progress Security Updates – 28 July 2026

The addressed vulnerabilities could allow the attacker to bypass security restrictions, gain elevated privileges, execute arbitrary operating system commands, and potentially gain unauthorized access to the affected system.

Sample of the addressed vulnerabilities:

1. Progress Kemp LoadMaster OS Command Injection Vulnerability (CVE-2026-59686):

• CVSS: 8.4
• Attack Vector: Adjacent Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Remote Code Execution

2. Progress MOVEit WAF Incorrect Authorization Vulnerability (CVE-2026- 59689):

• CVSS: 8.0
• Attack Vector: Adjacent Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

The affected products:

• Progress MOVEit WAF.
• Progress ECS Connection Manager.
• Progress Connection Manager.
• Progress Kemp LoadMaster.
• Progress Multi-Tenant LoadMaster.