High · 8.4 CVE-2026-3519 EUVD-2026-23858GHSA-g4q4-3mm2-2w69

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Published Apr 20, 2026 · Updated Apr 22, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: ECS Connections Manager Product: LoadMaster Product: MOVEit WAF Product: Object Scale Connection Manager

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command

Affected products

Vendor	Product	Affected	Fixed
Progress Software	LoadMaster	V7.2.45.0 – < V7.2.63.0	V7.2.63.0
Progress Software	ECS Connections Manager	V7.2.49.0 – < V7.2.63.0	V7.2.63.0
Progress Software	Object Scale Connection Manager	V7.2.62.0 – < V7.2.63.0	V7.2.63.0
Progress Software	MOVEit WAF	V7.2.62.0 – < V7.2.63.0	V7.2.63.0

Advisories 1

WID-SEC-2026-1185 Kemp LoadMaster und Progress Software MOVEit WAF: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2026

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 vendor-advisory

CNA	v3.1	8.4
EUVD	v3.1	8.4