CVE-2025-13447

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

At a glance

Severity: HIGH 8.4
EPSS: EPSS 27.22 % · percentile 98 (2026-10-27)
State: PUBLISHED
Published: 2026-01-13
Updated: 2026-02-26
Assigner: ProgressSoftware
NVD status: Analyzed

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · security@progress.com (Secondary)
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-78

European references

ENISA EUVD · EUVD-2026-2346
GCVE · GCVE-0-2025-13447

Affected configurations (NVD CPE)

cpe:2.3:a:progress:connection_manager_for_objectscale*:*:*:*:*:*:*:*:* < 7.2.62.2
cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* < 7.2.62.2
cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:* < 7.2.54.16
cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:* < 7.2.62.2
cpe:2.3:a:progress:moveit_waf:7.2.62.1:*:*:*:*:*:*:*
cpe:2.3:a:progress:multi-tenant_hypervisor:*:*:*:*:*:*:*:* < 7.1.35.15

Affected products

Product	Versions
Progress Software · LoadMaster	affected 7.2.50 < V7.2.62.2 ; affected 7.1.32 < V7.2.62.2 ; affected 7.2.37 < V7.2.62.2 ; affected 7.2.39 < V7.2.62.2 ; affected 7.2.50 < V7.2.54.16 ; affected 7.1.32 < V7.2.54.16

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD