OS Command Injection Vulnerability in Progress ADC Products
CVE-2026-3517

8.4HIGH

Key Information:

Vendor

Progress Software
Status
Loadmaster
Ecs Connections Manager
Object Scale Connection Manager
Moveit Waf
Vendor
CVE Published:
20 April 2026

What is CVE-2026-3517?

An OS Command Injection vulnerability exists in the API of Progress ADC Products, specifically affecting the LoadMaster appliance. This flaw allows an authenticated attacker with 'Geo Administration' permissions to execute arbitrary operating system commands. The vulnerability arises due to insufficient input sanitization in the 'addcountry' command, making it possible for attackers to craft malicious inputs that bypass security controls. Exploiting this vulnerability could lead to severe security breaches, posing risks to system integrity and data confidentiality.

Affected Version(s)

ECS Connections Manager 7.2.49.0

LoadMaster 7.1.32.0

MOVEit WAF 7.2.62.0

References

https://community.progress.com/s/article/LoadMaster-Secur...
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Argany of TrendAI Research
.