Read the docs

Progress

Records437All Threatist records
Exploited (KEV)10In CISA KEV
CVSS critical95CVSS 9.0–10.0
CVSS high231CVSS 7.0–8.9

Exploited now

Progress records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

26 records in Loadmaster · all components

TI-2026-07083 CVE-2026-8037 · GHSA-57pc-jm9r-hgj4

Command injection in Progress LoadMaster

Priority CRITICAL 100KEV

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in mu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99794 Published 2026-06-04 Fixed in V7.2.63.2, V7.2.54.18 CWE-77
Priority CRITICAL 100KEV

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.95388 Published 2024-02-21 Fixed in 7.2.48.10, 7.2.54.8 +1 CWE-78
TI-2024-02274 CVE-2024-2448 · GHSA-q953-jqf9-xxc3

LoadMaster Command Injection Vulnerability

Priority HIGH 73

An OS command injection vulnerability has been identified in LoadMaster.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.55422 Published 2024-03-22 Fixed in 7.2.59.3 ( LoadMaster GA), 7.2.54.9 ( LoadMaster LTSF) +2 CWE-78
Priority MEDIUM 61

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.27217 Published 2026-01-13 Fixed in V7.2.62.2, V7.2.54.16 CWE-78
Priority MEDIUM 61

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.27217 Published 2026-01-13 Fixed in V7.2.62.2, V7.2.54.16 +1 CWE-78
TI-2026-03031 CVE-2026-3518 · GHSA-wvwg-7g9q-g3v4

Command injection in Progress LoadMaster

Priority MEDIUM 55

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting uns…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.16877 Published 2026-04-20 Fixed in V7.2.63.0 CWE-77
TI-2026-03030 CVE-2026-3517 · GHSA-rw4j-jhfh-fr2h

Command injection in Progress LoadMaster

Priority MEDIUM 54

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.15488 Published 2026-04-20 Fixed in V7.2.63.0 CWE-77
Priority MEDIUM 49

A cross-site request forgery vulnerability has been identified in LoadMaster.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.1288 Published 2024-03-22 Fixed in 7.2.59.3 ( LoadMaster GA), 7.2.54.9 ( LoadMaster LTSF) +2 CWE-352
Priority MEDIUM 48

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.06286 Published 2025-02-05 Fixed in 7.2.61.0 CWE-20
Priority MEDIUM 47

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.06119 Published 2025-02-05 Fixed in 7.2.61.0 CWE-20
Priority MEDIUM 46

Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.04938 Published 2025-03-19 Fixed in 7.2.61.1, 7.1.35.14 CWE-121
Priority MEDIUM 45

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.4…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01172 Published 2024-10-11 Fixed in 7.2.61.0 CWE-20
TI-2026-03506 CVE-2026-4048 · GHSA-pwx9-99jm-fx95

Command injection in Progress LoadMaster

Priority MEDIUM 43

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsa…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.02132 Published 2026-04-20 Fixed in V7.2.63.0 CWE-77
TI-2026-03032 CVE-2026-3519 · GHSA-g4q4-3mm2-2w69

Command injection in Progress LoadMaster

Priority MEDIUM 43

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.02134 Published 2026-04-20 Fixed in V7.2.63.0 CWE-77
TI-2026-42564 CVE-2026-59688 · GHSA-c7jf-f6hx-vphp

OS command injection in Progress LoadMaster

Priority MEDIUM 42

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary op…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.01677 Published 2026-07-27 Fixed in 7.2.63.3, 7.2.54.19 CWE-78
TI-2026-42563 CVE-2026-59687 · GHSA-9x4p-3pwq-9h9m

OS command injection in Progress LoadMaster

Priority MEDIUM 42

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary op…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.01677 Published 2026-07-27 Fixed in 7.2.63.3, 7.2.54.19 CWE-78
TI-2026-42562 CVE-2026-59686 · GHSA-85mv-2c69-64f5

OS command injection in Progress LoadMaster

Priority MEDIUM 42

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary op…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.01677 Published 2026-07-27 Fixed in 7.2.63.3, 7.2.54.19 CWE-78
Priority LOW 39

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00603 Published 2025-02-05 Fixed in 7.2.61.0 CWE-20
Priority LOW 39

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00603 Published 2025-02-05 Fixed in 7.2.61.0 CWE-20
Priority LOW 39

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00603 Published 2025-02-05 Fixed in 7.2.61.0 CWE-20
Priority LOW 39

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.0 (inclusive) From 7.2.49.…

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00553 Published 2024-09-12 Fixed in 7.2.60.1 CWE-20
TI-2026-42566 CVE-2026-59690 · GHSA-68jj-c942-f24v

Missing authorization in Progress LoadMaster

Priority LOW 36

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform…

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00257 Published 2026-07-27 Fixed in 7.2.63.3, 7.2.54.19 +1 CWE-862
Priority LOW 36

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privilege…

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00257 Published 2026-07-27 Fixed in 7.2.63.3, 7.2.54.19 CWE-863
TI-2024-03304 CVE-2024-3544 · GHSA-5673-2x9h-2626

LoadMaster Hardcoded SSH Key

Priority LOW 35

Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group.

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00379 Published 2024-05-02 Fixed in 7.2.59.4, 7.2.54.10 +1 CWE-798
Load more
Open these records in search →