8.4 HighCWE-77
CVE-2026-3518
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress SoftwareLoadMaster
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
17%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
SeverityCVSS
8.4High
Description NVD
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
Coverage 1 article · 1 outlet
- Progress patches MOVEit WAF, LoadMaster command injection flawsSecurityWeek · first in our coverage · mentions it in passing