High · 8.4 CVE-2026-3517 EUVD-2026-23856GHSA-rw4j-jhfh-fr2h

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Published Apr 20, 2026 · Updated Apr 22, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: ECS Connections Manager Product: LoadMaster Product: MOVEit WAF Product: Object Scale Connection Manager

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command

Affected products

Vendor	Product	Affected	Fixed
Progress Software	LoadMaster	7.1.32.0 – < V7.2.63.0	V7.2.63.0
Progress Software	ECS Connections Manager	7.2.49.0 – < V7.2.63.0	V7.2.63.0
Progress Software	Object Scale Connection Manager	7.2.62.0 – < V7.2.63.0	V7.2.63.0
Progress Software	MOVEit WAF	7.2.62.0 – < V7.2.63.0	V7.2.63.0

Advisories 1

WID-SEC-2026-1185 Kemp LoadMaster und Progress Software MOVEit WAF: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2026

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 vendor-advisory

CNA	v3.1	8.4
EUVD	v3.1	8.4