Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Affected products
progress: connection manager for objectscale; progress: ecs connection manager; progress: moveit web application firewall; progress: multi-tenant hypervisor; progress: loadmaster
References4
- community.progress.com/s/article/Connection-Manager-for-ObjectS… Vendor Advisory
- community.progress.com/s/article/ECS-Connection-Manager-Vulnera… Vendor Advisory
- community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE… Vendor Advisory
- community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE… Vendor Advisory
Metrics
- CVSS 3.1
-
6.8
MEDIUM
Score source: NVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 27% percentile: 98 · as of 11 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.