Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-3517

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

At a glance

Severity
HIGH 8.4
EPSS
EPSS 15.49 % · percentile 97 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
ProgressSoftware
NVD status
Analyzed

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HProgressSoftware
CVSS 3.1HIGH 8.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HNVD · security@progress.com (Secondary)
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Progress Software · LoadMasteraffected 7.1.32.0 < V7.2.63.0
Progress Software · ECS Connections Manageraffected 7.2.49.0 < V7.2.63.0
Progress Software · Object Scale Connection Manageraffected 7.2.62.0 < V7.2.63.0
Progress Software · MOVEit WAFaffected 7.2.62.0 < V7.2.63.0

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD