High · 8.4 CVE-2026-4048 EUVD-2026-23859GHSA-pwx9-99jm-fx95

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Published Apr 20, 2026 · Updated Apr 22, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: ECS Connections Manager Product: LoadMaster Product: MOVEit WAF Product: Object Scale Connection Manager

Description

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

Affected products

Vendor	Product	Affected	Fixed
Progress Software	LoadMaster	V7.1.20.0 – < V7.2.63.0	V7.2.63.0
Progress Software	ECS Connections Manager	V7.2.49.0 – < V7.2.63.0	V7.2.63.0
Progress Software	Object Scale Connection Manager	V7.2.62.0 – < V7.2.63.0	V7.2.63.0
Progress Software	MOVEit WAF	V7.2.62.0 – < V7.2.63.0	V7.2.63.0

Advisories 1

WID-SEC-2026-1185 Kemp LoadMaster und Progress Software MOVEit WAF: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2026

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 vendor-advisory

CNA	v3.1	8.4
EUVD	v3.1	8.4