CVE-2026-4048

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:connection_manager_for_objectscale::::::::
	cpe:2.3:a:progress:ecs_connection_manager::::::::
	cpe:2.3:a:progress:loadmaster:::::ltsf:::*
	cpe:2.3:a:progress:loadmaster:::::ga:::*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de ejecución remota de código por inyección de comandos del sistema operativo en productos ADC de UI in Progress permite a un atacante autenticado con permisos de ’Todos’ ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando una entrada no saneada en un archivo de reglas WAF personalizado durante el proceso de carga de archivos.

Information

Published : 2026-04-20 14:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-4048

Mitre link : CVE-2026-4048

CVE.ORG link : CVE-2026-4048

JSON object : View

Products Affected

progress

connection_manager_for_objectscale
loadmaster
ecs_connection_manager

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-4048", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4048", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "LoadMaster", "versions": [{"status": "affected", "version": "V7.1.20.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "ECS Connections Manager", "versions": [{"status": "affected", "version": "V7.2.49.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "Object Scale Connection Manager", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "MOVEit WAF", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-20T14:16:20.700", "references": [{"url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876", "tags": ["Patch", "Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with \u201cAll\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por inyecci\u00f3n de comandos del sistema operativo en productos ADC de UI in Progress permite a un atacante autenticado con permisos de \u2019Todos\u2019 ejecutar comandos arbitrarios en el dispositivo LoadMaster explotando una entrada no saneada en un archivo de reglas WAF personalizado durante el proceso de carga de archivos."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29595DEA-0B11-4F15-9D98-2FE6B921E1BB", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73724463-A364-43DE-BF05-641226373DD6", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*", "vulnerable": true, "matchCriteriaId": "AC313444-74D6-491D-B7BA-36BF6382D4FC", "versionEndExcluding": "7.2.54.17"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*", "vulnerable": true, "matchCriteriaId": "A03DB1D6-4225-406D-8A53-3730266390C1", "versionEndExcluding": "7.2.63.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}