8.4 HighCWE-77
CVE-2026-3517
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress SoftwareLoadMaster
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
3.0%probability of exploitation in the next 30 days
Higher than 87% of scored CVEs
SeverityCVSS
8.4High
Description NVD
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
Coverage 1 article · 1 outlet
- Progress patches MOVEit WAF, LoadMaster command injection flawsSecurityWeek · first in our coverage