Read the docs
TI-2026-03032 Aliases CVE-2026-3519GHSA-g4q4-3mm2-2w69

Command injection in Progress LoadMaster

Priority MEDIUM 43CWE-77Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02134 82nd percentileScored 2026-11-07
Fix Fixed LoadMaster (Progress Software): V7.2.63.0ECS Connections Manager (Progress Software): V7.2.63.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressLoadMasterV7.2.45.0 to before V7.2.63.0V7.2.63.0Patch availableCNA
ProgressECS Connections ManagerV7.2.49.0 to before V7.2.63.0V7.2.63.0Patch availableCNA
ProgressObject Scale Connection ManagerV7.2.62.0 to before V7.2.63.0V7.2.63.0Patch availableCNA
ProgressMOVEit WAFV7.2.62.0 to before V7.2.63.0V7.2.63.0Patch availableCNA
  • LoadMaster VendorProgress Affected V7.2.45.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
  • ECS Connections Manager VendorProgress Affected V7.2.49.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
  • Object Scale Connection Manager VendorProgress Affected V7.2.62.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA
  • MOVEit WAF VendorProgress Affected V7.2.62.0 to before V7.2.63.0 Fixed in V7.2.63.0 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*before 7.2.63.1VulnerableProgress
cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*before 7.2.63.1VulnerableProgress
cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*before 7.2.54.17VulnerableProgress
cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*before 7.2.63.1VulnerableProgress
  • cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress
  • cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress
  • cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:* Versions before 7.2.54.17 Vulnerable ·Progress
  • cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:* Versions before 7.2.63.1 Vulnerable ·Progress

Remediation

  • Fix · CNA LoadMaster (Progress Software) Fixed in V7.2.63.0
  • Fix · CNA ECS Connections Manager (Progress Software) Fixed in V7.2.63.0
  • Fix · CNA Object Scale Connection Manager (Progress Software) Fixed in V7.2.63.0
  • Fix · CNA MOVEit WAF (Progress Software) Fixed in V7.2.63.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress Software ECS Connections Manager, LoadMaster and 2 more products — community.progress.com/s/article/LoadMaster-Security-Vulner…

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2026-03031 Command injection in Progress LoadMasterPriority MEDIUM 55
    • TI-2026-03030 Command injection in Progress LoadMasterPriority MEDIUM 54
    • TI-2026-03506 Command injection in Progress LoadMasterPriority MEDIUM 43
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3519
  2. 2026-10-03 Alias added: GHSA-g4q4-3mm2-2w69
  3. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Patch 1

  • TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-12291 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster CVSS 3.1HIGH 8.4
  • TI-2026-03031 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
  • TI-2026-03030 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
  • TI-2026-03506 Command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
  • TI-2026-42564 OS command injection in Progress LoadMaster CVSS 3.1HIGH 8.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences