Progress has identified five significant vulnerabilities in its Kemp LoadMaster products which could allow attackers to execute commands and gain unauthorized access to critical systems. These issues, impacting several older versions, have prompted urgent security advisories for affected users.
Tracked under identifiers CVE-2026-59686 through CVE-2026-59690, these vulnerabilities could lead to full system compromise if exploited by authenticated users. A security bulletin released on July 27, 2026, emphasized the importance of immediate action, although no active exploitation has been reported so far.
Command Injection Risks
Three of the identified vulnerabilities involve command injection flaws. CVE-2026-59686, for instance, allows attackers with high privileges to execute arbitrary commands via the LoadMaster management interface. Similarly, CVE-2026-59687 and CVE-2026-59688 pose risks through the Geo Location management and backup functionalities, respectively.
These command injection vulnerabilities could enable attackers with administrative access to gain complete control over the affected systems, posing severe risks to the integrity and security of the network infrastructure.
Access Control Weaknesses
The other two vulnerabilities pertain to broken access controls. CVE-2026-59689 allows low-privilege users to escalate their permissions to the root level, granting them extensive control over the system. This includes the ability to modify configurations, access sensitive data, and disrupt services.
Additionally, CVE-2026-59690, affecting the REST API, permits unauthorized privileged operations, which should be restricted according to user roles. This affects not only single deployments but also multi-tenant environments.
Urgent Upgrade Recommendations
The affected versions include Progress Kemp LoadMaster 7.2.63.27 and earlier, along with ECS Connection Manager and Connection Manager for ObjectScale. Users are strongly advised to upgrade to version 7.2.63.37 for GA users and 7.2.54.197 for LTSF users. Multi-Tenant LoadMaster customers should move to version 7.1.35.167.
Organizations still using unsupported versions are at risk and should transition to supported updates to ensure they receive ongoing security patches. Administrators should verify their software version via the web interface or appliance console to confirm compliance.
Given the authentication requirement for these vulnerabilities, enhancing security protocols is crucial. This includes reviewing administrative privileges, enforcing strong passwords, adopting multi-factor authentication, and monitoring system activities for suspicious behavior.
By taking these proactive measures, organizations can safeguard their systems against potential threats and maintain robust cybersecurity defenses.
