OS Command Injection Vulnerability in Progress LoadMaster Products
CVE-2026-4048

8.4HIGH

Key Information:

Vendor: Progress Software
Status: Loadmaster; Ecs Connections Manager; Object Scale Connection Manager; Moveit Waf
Vendor: CVE Published:; 20 April 2026

🔔 Create Progress Software Vulnerability Alert

What is CVE-2026-4048?

An OS Command Injection vulnerability exists in the UI of Progress LoadMaster products, enabling an authenticated user with full permissions to exploit unsanitized input during the file upload process of a custom Web Application Firewall (WAF) rule file. This vulnerability can potentially allow the attacker to execute arbitrary commands on the LoadMaster appliance, posing significant security risks.

Affected Version(s)

ECS Connections Manager V7.2.49.0

LoadMaster V7.1.20.0

MOVEit WAF V7.2.62.0

References

https://community.progress.com/s/article/LoadMaster-Secur...

vendor-advisory

CVSS V3.1

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 20, 2026
Vulnerability Reserved
Mar 12, 2026

CVE-2026-4048 Data

JSON