CVE-2026-4048
published 2026-04-20CVE-2026-4048: OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute…
PriorityP356high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.13%
79.7th percentile
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress | connection_manager_for_objectscale | < 7.2.63.1 | 7.2.63.1 |
| progress | ecs_connection_manager | < 7.2.63.1 | 7.2.63.1 |
| progress | loadmaster | < 7.2.54.17 | 7.2.54.17 |
| progress | loadmaster | < 7.2.63.1 | 7.2.63.1 |
| progress_software | ecs_connections_manager | >= V7.2.49.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | loadmaster | >= V7.1.20.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | moveit_waf | >= V7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
| progress_software | object_scale_connection_manager | >= V7.2.62.0 < V7.2.63.0 | V7.2.63.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pwx9-99jm-fx95: OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to exe
ghsa_unreviewed·2026-04-20
CVE-2026-4048 [HIGH] CWE-77 GHSA-pwx9-99jm-fx95: OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to exe
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.
VulDB
Progress LoadMaster prior 7.2.63.0 UI command injection
vuldb·2026-04-20·CVSS 8.4
CVE-2026-4048 [HIGH] Progress LoadMaster prior 7.2.63.0 UI command injection
A vulnerability has been found in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager and MOVEit WAF and classified as critical. This affects an unknown part of the component UI. Performing a manipulation results in command injection.
This vulnerability is known as CVE-2026-4048. Access to the local network is required for this attack. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
2026-04-20
Published