CVE-2026-3517
published 2026-04-20CVE-2026-3517: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions…
PriorityP265high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
18.24%
96.9th percentile
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | connection_manager_for_objectscale | < 7.2.63.1 | 7.2.63.1 |
| progress | ecs_connection_manager | < 7.2.63.1 | 7.2.63.1 |
| progress | loadmaster | < 7.2.54.17 | 7.2.54.17 |
| progress | loadmaster | < 7.2.63.1 | 7.2.63.1 |
| progress_software | ecs_connections_manager | >= 7.2.49.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | loadmaster | >= 7.1.32.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | moveit_waf | >= 7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | object_scale_connection_manager | >= 7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Progress LoadMaster prior 7.2.63.0 API command injection
vuldb·2026-04-20·CVSS 8.4
CVE-2026-3517 [HIGH] Progress LoadMaster prior 7.2.63.0 API command injection
A vulnerability classified as critical was found in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF. Affected is an unknown function of the component API. The manipulation results in command injection.
This vulnerability is reported as CVE-2026-3517. The attacker must have access to the local network to execute the attack. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-rw4j-jhfh-fr2h: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” pe
ghsa_unreviewed·2026-04-20
CVE-2026-3517 [HIGH] CWE-77 GHSA-rw4j-jhfh-fr2h: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” pe
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
No detection rules found.
No public exploits indexed.
2026-04-20
Published