Loadmaster CVE-2026-3519

Requires authenticated access with specifically the 'VS Administration' permission level in Progress LoadMaster/ADC management interface, not just any administrative account. The CVSS vector indicates adjacent network access (AV:A), meaning the attacker must be on the same network segment as the management interface or have Layer 2/3 adjacency (not achievable from the public internet unless the management interface is exposed, which violates deployment best practices). Attack requires identifying the vulnerable 'aclcontrol' API endpoint and crafting input that bypasses any client-side validation while injecting shell metacharacters. Exploitation is limited to the specific product versions listed (7.2.45.0-7.2.62.x range varies by product). The Changed scope (S:C) and high CVSS impact ratings indicate successful exploitation breaks out of API process context to affect the underlying OS, but initial access still requires the high-privilege administrator role.

Real-world risk is moderate despite CVSS 8.4 due to significant exploitation barriers. CVSS vector (AV:A/AC:L/PR:H/UI:N/S:C) requires adjacent network access (not internet-reachable), high-privilege authenticated credentials with specific 'VS Administration' role, and the Changed scope indicates lateral movement potential once inside. SSVC framework assessment confirms: exploitation=none (no active exploitation), automatable=no (requires pre-existing admin credentials), technical impact=total (complete system compromise). This combination indicates the vulnerability is severe for insiders or after initial compromise but not a first-stage attack vector. The authentication requirement (PR:H) significantly reduces attacker pool compared to unauthenticated RCE. However, management interfaces are common targets for credential theft and lateral movement, making this valuable in multi-stage attacks against Progress ADC deployments. Patch availability in version 7.2.63.0 across all products suggests coordinated disclosure and vendor response. Organizations using these products should prioritize patching if management interfaces are accessible from corporate networks or if admin credential compromise is part of their threat model.

An attacker who has compromised credentials for a Progress LoadMaster administrator account with 'VS Administration' permissions (obtained via phishing, credential reuse, or prior compromise of an admin workstation) connects to the appliance management API from an adjacent network segment. The attacker crafts a malicious API request to the 'aclcontrol' command containing shell metacharacters and injected OS commands (e.g., backticks, semicolons, pipe operators) in a parameter that the API passes unsanitized to the underlying shell. The LoadMaster executes the injected commands with the privileges of the API service process, granting the attacker arbitrary code execution on the appliance operating system, allowing installation of persistence mechanisms, data exfiltration, or pivoting to other network segments managed by the load balancer.