LoadMaster Critical Security Bulletin – July 2026 – (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690)

The Progress Kemp LoadMaster team recently confirmed a series of high-severity vulnerabilities in Progress Kemp LoadMaster, Progress ECS Connection Manager and Progress Connection Manager for ObjectScale GA v7.2.63.2 and older, Progress Kemp LoadMaster LTSF v7.2.54.18 and older (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690), and Progress Kemp Multi-Tenant LoadMaster v7.1.35.15 and older (CVE-2026-59690 only). We have addressed the issues and have developed and tested a patch that is now available. Currently, we have not received any reports that this vulnerability has been exploited, and we are not aware of any direct operational impact to customers.

Jul 27, 2026
Knowledge

Title

URL Name

LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

Article Number

000302724

Information

CVE-2026-59686 - OS Command Injection vulnerability

An OS Command Injection vulnerability allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

CVE-2026-59687 - OS Command Injection vulnerability

An OS Command Injection vulnerability allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

CVE-2026-59688 - OS Command Injection vulnerability

An OS Command Injection vulnerability allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

CVE-2026-59689 - Incorrect authorization vulnerability

An incorrect authorization vulnerability allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

CVE-2026-59690 - Missing authorization vulnerability

A missing authorization vulnerability allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

Note that there are no known indicators of compromise at this time.

What are the impacts?

Affects:

Progress Kemp LoadMaster, Progress ECS Connection Manager and Progress Connection Manager for ObjectScale: GA v7.2.63.2 and older

Progress Kemp LoadMaster: LTSF v7.2.54.18 and older

Multi-Tenant LoadMaster V7.1.35.15 and older (CVE-2026-59690 only)

 
If you have any questions or concerns related to this issue, please log in to open a Technical Support case. Technical Support is available to Kemp LoadMaster customers under warranty and active maintenance. If your version is no longer supported as part of the Product Lifecyle Policy, you should upgrade to a supported and fixed version.
 

What actions do I need to take?

 
Solution 
We have addressed the vulnerabilities, and the Progress Kemp LoadMaster team strongly recommends performing an upgrade to the latest version listed in the table below. 

For all customers on a current maintenance agreement, the upgrade can be accessed by logging into the Progress Community or by clicking on one of the links below. Customers who are not on a current maintenance agreement should contact a Progress Sales Representative or their respective Partner.
 
To confirm your current version of Kemp LoadMaster, please log in to the web UI and find the version string in the top-right corner or look at the console after booting the appliance to find version information.

Vulnerable Version	Fixed Version(s)	Documentation
Progress Kemp LoadMaster GA v7.2.63.2 and all prior versions	Progress Kemp LoadMaster v7.2.63.3	Link to documentation
Progress Kemp LoadMaster LTSF v7.2.54.18 and all prior versions	Progress Kemp LoadMaster LTSF v7.2.54.19
Progress ECS Connection Manager v7.2.63.2 and all prior versions	Progress ECS Connection Manager v7.2.63.3
Progress Connection Manager for ObjectScale v7.2.63.2 and all prior versions	Progress Connection Manager for ObjectScale v7.2.63.3
Progress Kemp Multi-Tenant LoadMaster v7.1.35.15 and all prior versions	Progress Kemp Multi-Tenant LoadMaster v7.1.35.16

 
Additional Information

To receive email notifications for Product and Security Updates like this, please log in to the Progress Community Portal and sign up for our Progress Alert and Notification Service (PANS).

Please see our FAQ page regarding Frequently Asked Questions (FAQ) for Progress Alert Notifications (PANS).

Additional Information

Environment

Last Modified Date

7/27/2026 10:06 AM

Disclaimer

Defect Number