OS Command Injection Vulnerability in Progress LoadMaster Products
CVE-2026-3518

8.4HIGH

Key Information:

Vendor: Progress Software
Status: Loadmaster; Ecs Connections Manager; Object Scale Connection Manager; Moveit Waf
Vendor: CVE Published:; 20 April 2026

🔔 Create Progress Software Vulnerability Alert

What is CVE-2026-3518?

An OS Command Injection vulnerability in the API of Progress LoadMaster products permits an authenticated attacker with full permissions to execute arbitrary commands on the LoadMaster appliance. This occurs due to unsanitized input accepted by the 'killsession' command, which could lead to unauthorized control over the affected systems.

Affected Version(s)

ECS Connections Manager V7.2.49.0

LoadMaster V7.2.37.0

MOVEit WAF V7.2.62.0

References

https://community.progress.com/s/article/LoadMaster-Secur...

vendor-advisory

CVSS V3.1

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 20, 2026
Vulnerability Reserved
Mar 4, 2026

Credit

Michael Argany of TrendAI Research

CVE-2026-3518 Data

JSON