Progress MOVEit Web Application Firewall vulnerabilities

7 CVEs affecting Progress MOVEit Web Application Firewall, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59690, published 2026-07-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability, published 2026-06-04. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-08-07. EPSS: 77.4% chance of exploitation in the next 30 days. OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting…
CVE-2025-13444, published 2026-01-13. Medium severity, CVSS 6.8. EPSS: 27.2% chance of exploitation in the next 30 days. OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the…
CVE-2026-59688, published 2026-07-27. High severity, CVSS 8.4. EPSS: 1.7% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to…
CVE-2026-59687, published 2026-07-27. High severity, CVSS 8.4. EPSS: 1.7% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to…
CVE-2026-59686, published 2026-07-27. High severity, CVSS 8.4. EPSS: 1.7% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to…
CVE-2026-59690, published 2026-07-27. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low…
CVE-2026-59689, published 2026-07-27. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges…