Skip to content
OpenAdvisories
High WID-SEC-2026-1185 5 CVEs

Kemp LoadMaster und Progress Software MOVEit WAF: Mehrere Schwachstellen

Published Apr 20, 2026 · Updated May 21, 2026 · Revision 2 · de-DE

Vendor: Kemp Vendor: Progress Software Product: LoadMaster Product: MOVEit Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Kemp LoadMaster und Progress Software MOVEit WAF ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsmaßnahmen zu umgehen.

Product

LoadMaster ist eine Load Balancer Lösung von Progress Software.
Progress MOVEit ist eine sichere Managed File Transfer (MFT)-Software, die Transparenz und Kontrolle über die Dateiübertragungsaktivitäten bietet.

Vulnerabilities 5

  • Critical 9.3
    CVE-2026-21876 Public exploit EPSS 17%

    OWASP CRS has multipart bypass using multiple content-type parts

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the …

    coreruleset coreruleset modsecurity-crs modsecurity-crs Debian Ubuntu
  • High 8.4
    CVE-2026-3517 EPSS 15%

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'a…

    Progress Software LoadMaster Object Scale Connection Manager MOVEit WAF
  • High 8.4
    CVE-2026-3518 EPSS 17%

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' com…

    Progress Software LoadMaster MOVEit WAF Object Scale Connection Manager
  • High 8.4
    CVE-2026-3519

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'ac…

    Progress Software LoadMaster Object Scale Connection Manager MOVEit WAF
  • High 8.4
    CVE-2026-4048

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file…

    Progress Software LoadMaster MOVEit WAF Object Scale Connection Manager

Revision history

  1. #2

    Referenz(en) aufgenommen: ZDI-26-319, ZDI-CAN-29249, ZDI-26-318, ZDI-CAN-29222

  2. #1

    Initiale Fassung

References