Command injection in Progress LoadMaster
Priority MEDIUM 54CWE-77Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15488 96th percentileScored 2026-11-07
Fix Fixed LoadMaster (Progress Software): V7.2.63.0ECS Connections Manager (Progress Software): V7.2.63.0+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progress | LoadMaster | 7.1.32.0 to before V7.2.63.0 | V7.2.63.0 | Patch available | CNA |
| Progress | ECS Connections Manager | 7.2.49.0 to before V7.2.63.0 | V7.2.63.0 | Patch available | CNA |
| Progress | Object Scale Connection Manager | 7.2.62.0 to before V7.2.63.0 | V7.2.63.0 | Patch available | CNA |
| Progress | MOVEit WAF | 7.2.62.0 to before V7.2.63.0 | V7.2.63.0 | Patch available | CNA |
- LoadMaster VendorProgress Affected 7.1.32.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
- ECS Connections Manager VendorProgress Affected 7.2.49.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
- Object Scale Connection Manager VendorProgress Affected 7.2.62.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
- MOVEit WAF VendorProgress Affected 7.2.62.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:* | before 7.2.63.1 | Vulnerable | Progress |
| cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* | before 7.2.63.1 | Vulnerable | Progress |
| cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:* | before 7.2.54.17 | Vulnerable | Progress |
| cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:* | before 7.2.63.1 | Vulnerable | Progress |
- cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress
- cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress
- cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:* Versions before 7.2.54.17 Vulnerable ·Progress
- cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress
Remediation
- Fix · CNA LoadMaster (Progress Software) Fixed in V7.2.63.0
- Fix · CNA ECS Connections Manager (Progress Software) Fixed in V7.2.63.0
- Fix · CNA Object Scale Connection Manager (Progress Software) Fixed in V7.2.63.0
- Fix · CNA MOVEit WAF (Progress Software) Fixed in V7.2.63.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Progress Software ECS Connections Manager, LoadMaster and 2 more products — community.progress.com/s/article/LoadMaster-Security-Vulner…
4 records Highest priority Priority MEDIUM 4 MEDIUM
Other records, highest priority first
- TI-2026-03031 Command injection in Progress LoadMasterPriority MEDIUM 55
- TI-2026-03506 Command injection in Progress LoadMasterPriority MEDIUM 43
- TI-2026-03032 Command injection in Progress LoadMasterPriority MEDIUM 43
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3517
- 2026-10-03 Alias added: GHSA-rw4j-jhfh-fr2h
- 2026-10-11 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the 95th–99th percentile
References
More Progress Connection Manager For Objectscale vulnerabilities
- TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
- TI-2025-12291 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster CVSS 3.1HIGH 8.4
- TI-2026-03031 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
- TI-2026-03506 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
- TI-2026-03032 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
- TI-2026-42564 OS command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
Sources
- CVE-2026-3517 · CVE Program
- CVE-2026-3517 · NVD
- FIRST EPSS
- GHSA-rw4j-jhfh-fr2h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences