Vulnerability CVE-2026-21876: Bypass of WAF in Progress MOVEit and LoadMaster

Progress Software fixes critical vulnerabilities in MOVEit WAF and LoadMaster

Progress Software has resolved five high-impact vulnerabilities in MOVEit WAF and Kemp LoadMaster, including a firewall bypass (CVE-2026-21876) that allowed attackers to bypass protections without authentication. The flaw, discovered by Daytrift Newgen, exploited a bug in the OWASP CRS rule set to bypass controls via encoded multipart HTTP requests.

Quick Response

Critical vulnerabilities in detail

The CVE-2026-21876 represented a significant threat: it allowed sending malicious payloads hidden in multipart requests with modified charsets, completely bypassing the WAF filters. According to the OWASP team, the exploit was "trivial" once the technique was known.

The other four vulnerabilities (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048) allowed OS command injections, potentially with remote code execution. All these defects required authentication, but the combined impact with the WAF bypass could have been devastating.

History and operational risks

This discovery takes on particular importance in light of the 2023 attack on the MOVEit Transfer platform, exploited by the Cl0p group to steal data from hundreds of organizations. Although the current vulnerabilities are not directly related, they highlight the continued need to carefully monitor Progress Software products.

The OWASP team emphasized how the bug demonstrates the complexity in developing rules for WAFs, especially when handling collection variables and concatenated rules. This technical aspect is crucial for security administrators implementing application protection solutions.

Patch availability and recommendations

• MOVEit WAF v7.2.63.0
• Kemp LoadMaster v7.2.63.1
• Kemp LoadMaster LTSF v7.2.54.17
• ECS Connection Manager v7.2.63.1

Unlike on-premise versions, MOVEit Cloud has already been automatically updated, eliminating the need for user intervention.

Considerations for corporate security

Despite no reports of active exploitation, the company strongly recommends applying the patches as soon as possible. This is particularly crucial for organizations handling sensitive data or previously affected by attacks similar to those of the Cl0p group.

For companies relying on these solutions, it is essential to integrate this update into a broader risk management strategy, including:

• Continuous vulnerability monitoring
• Implementation of a patch management plan
• Periodic review of security configurations
• Training staff on cybersecurity best practices

Implications for the security industry

This case underscores the importance of keeping both commercial products and open-source libraries like OWASP CRS up to date. For security solution providers, it serves as an example of how even seemingly minor components can become critical points of vulnerability.

For end users, it is a reminder that web application security requires a multi-phase approach: in addition to the WAF, it is essential to implement intrusion detection systems (IDS), use machine learning to identify anomalous attack patterns, improve the management of collection variables and concatenated rules, and develop automated testing tools for WAF rules.

Lesson learned: a proactive approach to security

This case highlights the importance of adopting a proactive approach to cybersecurity. As observed by Bruce Schneier, cybersecurity expert, "perfect defense is impossible, but we can continuously improve our detection and response capabilities".

For organizations, this means:

• Investing in threat intelligence capabilities
• Implementing bug bounty programs to discover vulnerabilities
• Conducting regular security audits
• Training staff on the latest threats and attack techniques

While Progress Software continues to improve its solutions, this episode serves as a reminder that cybersecurity is an ongoing process that requires constant attention and updating of knowledge.

Frequently asked questions

1. What is the difference between the CVE-2026-21876 vulnerability and the other four?

The CVE-2026-21876 allowed WAF bypass without authentication, while the other four (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048) required authentication but could lead to OS command injections.

2. How can I verify if my system is vulnerable?

Progress Software has provided detailed guidelines in their security bulletin. It is advisable to perform a complete system audit and compare the installed versions with the updated ones.

3. What are the best practices to prevent similar attacks in the future?

In addition to applying patches, it is essential to implement a defense-in-depth approach that includes:

• Implementation of role-based access controls
• Encryption of sensitive data
• Regular and tested backups
• Updated incident response plans

4. How can I stay updated on similar threats?

Subscribing to specialized newsletters such as Help Net Security and participating in discussion forums such as those of Progress Software Community can be useful to stay informed about the latest threats and solutions.