CVE-2026-3517

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:connection_manager_for_objectscale::::::::
	cpe:2.3:a:progress:ecs_connection_manager::::::::
	cpe:2.3:a:progress:loadmaster:::::ltsf:::*
	cpe:2.3:a:progress:loadmaster:::::ga:::*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Ejecución Remota de Código por Inyección de Comandos en el Sistema Operativo en la API en Productos Progress ADC permite a un atacante autenticado con permisos de ’Geo Administration’ ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando la entrada no saneada en el comando ’addcountry’.

Information

Published : 2026-04-20 14:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-3517

Mitre link : CVE-2026-3517

CVE.ORG link : CVE-2026-3517

JSON object : View

Products Affected

progress

connection_manager_for_objectscale
loadmaster
ecs_connection_manager

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-3517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3517", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "LoadMaster", "versions": [{"status": "affected", "version": "7.1.32.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "ECS Connections Manager", "versions": [{"status": "affected", "version": "7.2.49.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "Object Scale Connection Manager", "versions": [{"status": "affected", "version": "7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "MOVEit WAF", "versions": [{"status": "affected", "version": "7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-20T14:16:19.330", "references": [{"url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cGeo Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command"}, {"lang": "es", "value": "Vulnerabilidad de Ejecuci\u00f3n Remota de C\u00f3digo por Inyecci\u00f3n de Comandos en el Sistema Operativo en la API en Productos Progress ADC permite a un atacante autenticado con permisos de \u2019Geo Administration\u2019 ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando la entrada no saneada en el comando \u2019addcountry\u2019."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29595DEA-0B11-4F15-9D98-2FE6B921E1BB", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73724463-A364-43DE-BF05-641226373DD6", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*", "vulnerable": true, "matchCriteriaId": "AC313444-74D6-491D-B7BA-36BF6382D4FC", "versionEndExcluding": "7.2.54.17"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*", "vulnerable": true, "matchCriteriaId": "A03DB1D6-4225-406D-8A53-3730266390C1", "versionEndExcluding": "7.2.63.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}