CVE-2026-3518
published 2026-04-20CVE-2026-3518: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute…
PriorityP357high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.52%
82.9th percentile
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | connection_manager_for_objectscale | < 7.2.63.1 | 7.2.63.1 |
| progress | ecs_connection_manager | < 7.2.63.1 | 7.2.63.1 |
| progress | loadmaster | < 7.2.54.17 | 7.2.54.17 |
| progress | loadmaster | < 7.2.63.1 | 7.2.63.1 |
| progress_software | ecs_connections_manager | >= V7.2.49.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | loadmaster | >= V7.2.37.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | moveit_waf | >= V7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | object_scale_connection_manager | >= V7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wvwg-7g9q-g3v4: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to ex
ghsa_unreviewed·2026-04-20
CVE-2026-3518 [HIGH] CWE-77 GHSA-wvwg-7g9q-g3v4: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to ex
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
VulDB
Progress LoadMaster prior 7.2.63.0 API command injection
vuldb·2026-04-20·CVSS 8.4
CVE-2026-3518 [HIGH] Progress LoadMaster prior 7.2.63.0 API command injection
A vulnerability, which was classified as critical, has been found in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF. Affected by this vulnerability is an unknown functionality of the component API. This manipulation causes command injection.
This vulnerability appears as CVE-2026-3518. The attacker needs to be present on the local network. There is no available exploit.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-04-20
Published