Missing Authorization in LoadMaster - CVE-2026-59690
Published: July 27, 2026 / Updated: July 29, 2026
Vulnerability identifier: #VU139984
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59690
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform privileged administrative operations.
The vulnerability exists due to missing authorization in the REST API when handling administrative requests. A remote user can send crafted API requests to perform privileged administrative operations.
The issue affects access to administrative operations that should not be available at the user's permission level.
Affected software
LoadMaster
MOVEit WAF
MOVEit WAF
How to mitigate CVE-2026-59690
Install security update from vendor's website.
LoadMaster - addressed in versions 7.2.54.19, 7.2.63.3
MOVEit WAF - update to 7.2.63.3
MOVEit WAF - update to 7.2.63.3