Progress security advisory (AV26-755)

criticalCVE-2026-59686 CVE-2026-59687 CVE-2026-59688 CVE-2026-59689 CVE-2026-59690

Serial Number: AV26-755 Date: July 28, 2026 As of July 27, 2026, Progress Software is affected by vulnerabilities in the following products: ECS Connection Manager Prior to 7.2.63.3 LoadMaster Prior to 7.2.54.19 Prior to 7.2.63.3 MOVEit WAF Prior to 7.2.63.3 Multi Tenant Prior to 7.1.35.16 Object Scale Connection Manager Prior to 7.2.63.3 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. LoadMaster Critical Security Bulletin – July 2026 – (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690)

CSIRTS triage

vendor: Progress Software product: ECS Connection ManagerOtheraffected: Prior to 7.2.63.3

What: Progress Software products have vulnerabilities that could potentially be exploited.
Who is affected: Users and administrators of ECS Connection Manager, LoadMaster, MOVEit WAF, Multi Tenant, and Object Scale Connection Manager prior to specified versions.
Urgency: Remediation is necessary as vulnerabilities could be exploited, although the severity is currently unknown.
Action: Users should apply updates as they become available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ECS Connection Manager

Get an email when a new ECS Connection Manager advisory drops — max one per day, one-click unsubscribe.

Details

Source: Canadian Centre for Cyber Security (CA · national-cert · site)
Severity: critical
Published: 2026-07-28
Exploitation: Not in CISA KEV at last sync

Original advisory: https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-596860.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all scored CVEs.
Low exploitation riskCVE-2026-596870.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-596880.72% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-596890.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.
Low exploitation riskCVE-2026-596900.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59686	coverage & exploitation status	NVD · CVE.org
CVE-2026-59687	coverage & exploitation status	NVD · CVE.org
CVE-2026-59688	coverage & exploitation status	NVD · CVE.org
CVE-2026-59689	coverage & exploitation status	NVD · CVE.org
CVE-2026-59690	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.