CVE-2026-59690: Progress Software Privilege Escalation Flaw

CVE-2026-59690 Overview

CVE-2026-59690 is a Missing Authorization vulnerability [CWE-862] affecting Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant products. The flaw allows an authenticated attacker holding low-privilege credentials to invoke privileged administrative operations through the REST API. The REST endpoints fail to enforce role-based access control, granting non-administrative users access to functionality reserved for administrators. Successful exploitation can lead to full system compromise across affected Progress products.

Critical Impact
An adjacent-network attacker with low-privilege credentials can execute administrative REST API operations, leading to compromise of confidentiality, integrity, and availability across affected Progress Software products.

Affected Products

Progress LoadMaster
Progress ECS Connection Manager and Object Scale Connection Manager
Progress MOVEit WAF and Multi Tenant LoadMaster

Discovery Timeline

2026-07-27 - CVE-2026-59690 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database
July 2026 - Progress publishes the LoadMaster Critical Security Bulletin covering CVE-2026-59690 alongside four related issues

Technical Details for CVE-2026-59690

Vulnerability Analysis

The vulnerability originates in how the REST API authorizes requests after authentication. The API validates that the requester holds a valid session but does not verify that the associated role possesses the permissions required for the requested administrative operation. As a result, endpoints exposing configuration changes, tenant management, and other privileged workflows are reachable by users provisioned only with low-privilege roles.

Because the vulnerable code path is shared across the LoadMaster REST layer, the issue extends to ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant deployments that rely on the same management surface. The attack vector is Adjacent Network, meaning the attacker must reach the management interface, which is typically constrained to internal or management VLANs. Authentication is required, but any valid low-privilege account is sufficient. The EPSS probability of 0.175% reflects low observed exploitation activity at publication time.

Root Cause

The root cause is a Missing Authorization check [CWE-862]. The REST API relies on authentication tokens without a subsequent permission enforcement step that maps the caller's role to the requested action. Administrative routes therefore treat authenticated non-admin callers as if they held equivalent privileges.

Attack Vector

An attacker authenticates to the LoadMaster management interface using any valid low-privilege account, whether obtained through phishing, credential reuse, or an insider role. The attacker then issues REST API calls to administrative endpoints, bypassing the intended role separation. See the Progress LoadMaster Security Bulletin for technical guidance. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-59690

Indicators of Compromise

Unexpected administrative REST API calls originating from accounts that are not members of the administrator role.
New administrative users, virtual services, or SSL certificates created outside of change-control windows.
REST API traffic from workstations or subnets that do not normally manage LoadMaster appliances.
Configuration exports or backups downloaded by low-privilege accounts.

Detection Strategies

Correlate REST API request paths against the calling user's role; flag any privileged path invoked by a non-administrator.
Baseline management-plane API activity per user account and alert on deviations in request volume, endpoint diversity, or off-hours access.
Alert on any 2xx response to administrative endpoints when the authenticated principal lacks the administrator role.

Monitoring Recommendations

Forward LoadMaster audit and REST API logs to a centralized SIEM for retention and correlation with identity events.
Monitor management interfaces for scanning behavior, repeated 401/403 responses, and enumeration of REST paths.
Track privileged configuration changes and validate each against an approved change ticket.

How to Mitigate CVE-2026-59690

Immediate Actions Required

Apply the patched LoadMaster and Multi Tenant firmware versions listed in the Progress security bulletin as the primary remediation.
Restrict access to the management REST API to a dedicated management network or jump host using ACLs.
Rotate credentials for all low-privilege accounts on affected appliances and remove any accounts that are no longer required.
Review recent administrative changes and audit logs for evidence of unauthorized activity prior to patching.

Patch Information

Progress Software has released fixed builds for LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant LoadMaster. Refer to the Progress LoadMaster Critical Security Bulletin - July 2026 for the specific fixed versions and upgrade guidance.

Workarounds

Limit the management interface to trusted administrative subnets via firewall rules or the appliance's built-in access controls.
Enforce multi-factor authentication on all LoadMaster user accounts to raise the cost of low-privilege credential compromise.
Disable or delete unused low-privilege accounts and enforce least-privilege role assignment as an interim control.

bash

# Example: restrict LoadMaster management REST API to a management subnet
# Replace 10.20.30.0/24 with your management network
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP