What is the CVSS score of CVE-2026-3518?

CVE-2026-3518 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Loadmaster are affected by CVE-2026-3518?

CVE-2026-3518 is a command injection vulnerability in Progress LoadMaster and related products that allows authenticated administrators to execute arbitrary OS commands on the appliance, potentially…

How to fix or mitigate CVE-2026-3518?

Within 24 hours: Inventory all Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF instances and document current versions. Within 7 days: Restrict administrative access to these appliances to only essential personnel, enforce multi-factor authentication on all admin accounts, and implement network segmentation to limit lateral movement from compromised appliances. Within 30 days: Monitor Progress Software security advisories for patch release and conduct a comprehensive review of administrative activity logs for any suspicious killsession parameter usage.

Loadmaster CVE-2026-3518

EUVD-2026-23857 HIGH

Command Injection (CWE-77)

2026-04-20 ProgressSoftware

GHSA-wvwg-7g9q-g3v4

Command Injection RCE Loadmaster Ecs Connections Manager Object Scale Connection Manager Moveit Waf

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 14:32 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 14:15 euvd

EUVD-2026-23857

Analysis Generated

Apr 20, 2026 - 14:15 vuln.today

CVE Published

Apr 20, 2026 - 13:29 nvd

HIGH 8.4

DescriptionCVE.org

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command

AnalysisAI

OS command injection in Progress LoadMaster, MOVEit WAF, ECS Connections Manager, and Object Scale Connection Manager API allows authenticated attackers with 'All' permissions to execute arbitrary commands on appliances via unsanitized input in the 'killsession' API endpoint. CVSS 8.4 (High) reflects adjacent network access vector and high privileges requirement, limiting exploitation to administrators or compromised admin accounts. CISA SSVC assessment indicates no active exploitation, non-automatable attack, but total technical impact. EPSS data not provided, but privilege requirements significantly reduce real-world attack surface compared to unauthenticated RCE vulnerabilities.

Technical ContextAI

This vulnerability exploits CWE-77 (Improper Neutralization of Special Elements used in a Command) in the API layer of Progress Application Delivery Controller (ADC) products. The affected CPE strings identify four distinct Progress products sharing common API code: LoadMaster load balancer, MOVEit WAF (web application firewall), ECS Connections Manager (Dell EMC ECS storage gateway), and Object Scale Connection Manager (object storage gateway). The 'killsession' API command fails to sanitize user-supplied input before passing it to underlying OS shell execution functions. All products share the same vulnerable API codebase in versions 7.2.x prior to 7.2.63.0, with LoadMaster vulnerable from 7.2.37.0 and other products from later 7.2.x versions. The adjacent network attack vector (AV:A) suggests exploitation requires Layer 2 network access or compromised VPN/internal network position, not internet-wide exposure.

RemediationAI

Upgrade all affected Progress ADC products to version 7.2.63.0 or later, which contains vendor-released patches addressing the command injection vulnerability in the killsession API endpoint per Progress advisory EUVD-2026-23857. Download patches from Progress Community portal at https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876. If immediate patching is not feasible, implement compensating controls: restrict 'All' permission accounts to absolute minimum required administrators with multi-factor authentication enforced; audit all accounts with elevated permissions and revoke unnecessary access; enable detailed API audit logging to detect killsession command usage with suspicious parameters; implement network segmentation to limit adjacent network access to ADC management interfaces (restrict Layer 2 broadcast domains and disable management interface access from untrusted VLANs); deploy intrusion detection signatures monitoring for shell metacharacters in API POST requests to killsession endpoints. Note that restricting API access may impact legitimate automation workflows using privileged accounts-coordinate with application teams before implementing access controls. Compensating controls reduce but do not eliminate risk since legitimate admin access remains necessary for operations.