Critical Vulnerabilities in Progress LoadMaster Allow Command Execution

Five high-severity vulnerabilities have been identified in Progress LoadMaster and related systems, tracked as CVE-2026-59686 to CVE-2026-59690. These flaws could allow authenticated users to execute arbitrary commands and gain root access, potentially compromising entire appliances. The vulnerabilities affect older versions of Kemp LoadMaster, ECS Connection Manager, and ObjectScale appliances. Progress released a critical security bulletin on July 27, 2026, detailing these issues and recommending immediate updates. Currently, there are no reports of active exploitation, but the vulnerabilities pose a significant risk if left unpatched. Administrators are urged to apply the latest patches to mitigate potential attacks. The vulnerabilities were publicly disclosed on the same day as the advisory.

Key Points: • Five critical vulnerabilities in Progress LoadMaster could lead to complete appliance compromise. • Affected CVEs include CVE-2026-59686 through CVE-2026-59690, all published on July 27, 2026. • No active exploitation has been reported, but immediate patching is recommended to prevent potential attacks.