Command Injection Alert: High-Severity Flaws Hit LoadMaster & MOVEit WAF

Progress Software Corporation issued patches on 12 January 2026 for two high-severity command injection vulnerabilities affecting LoadMaster load balancers and MOVEit Web Application Firewalls (WAF). The flaws, tracked as CVE-2025-13444 and CVE-2025-13447, have a CVSS score of 8.4 and could allow remote attackers to inject arbitrary system commands by sending specially crafted requests to UI/API endpoints.

CVE-2025-13444 targets the getcipherset command within the UI/API, while CVE-2025-13447 affects a broader range of administrative commands such as addapikey, delapikey, delcert, dmidecode, listapikeys, and ssodomain; if exploited, attackers could gain full control over the appliance. As of the release date, there was no evidence of exploitation in the wild, according to the advisory, which also emphasises that vulnerable systems should be patched to avoid exploitation.

Administrators are urged to upgrade to specific GA or LTSF releases for LoadMaster and MOVEit WAF, with a two-step patch process required for Multi-Tenant LoadMaster deployments.