What is the CVSS score of CVE-2026-3519?

CVE-2026-3519 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Loadmaster are affected by CVE-2026-3519?

Progress LoadMaster and ADC products contain a high-severity command injection vulnerability (CVSS 8.4) affecting administrative API endpoints that allows authenticated users with VS Administration…

How to fix or mitigate CVE-2026-3519?

Within 24 hours: Identify and inventory all affected Progress LoadMaster and ADC deployments; restrict network access to the 'aclcontrol' API endpoint to trusted administrative hosts only using firewall rules; audit administrative account access logs for the 'VS Administration' role. Within 7 days: Disable the 'aclcontrol' API endpoint if operationally feasible; enforce multi-factor authentication for all accounts with VS Administration permissions; conduct a security review of administrative access permissions. Within 30 days: Contact Progress Software for patch availability status and timeline; evaluate replacement or upgrade options if patches remain unavailable; implement API request logging and anomaly detection for administrative endpoints.

Loadmaster CVE-2026-3519

EUVD-2026-23858 HIGH

Command Injection (CWE-77)

2026-04-20 ProgressSoftware

GHSA-g4q4-3mm2-2w69

Command Injection RCE Loadmaster Ecs Connections Manager Object Scale Connection Manager Moveit Waf

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 14:32 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 14:15 euvd

EUVD-2026-23858

Analysis Generated

Apr 20, 2026 - 14:15 vuln.today

CVE Published

Apr 20, 2026 - 13:32 nvd

HIGH 8.4

DescriptionCVE.org

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command

AnalysisAI

Command injection in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF allows authenticated administrators with 'VS Administration' privileges to execute arbitrary operating system commands on the appliance via unsanitized input to the 'aclcontrol' API command. CVSS 8.4 reflects high-privilege requirement but scope change indicates container escape or cross-boundary impact. EPSS data not provided. No public exploit identified at time of analysis. Vendor-released patch: version 7.2.63.0 for all affected products per Progress advisory.

Technical ContextAI

This vulnerability exploits CWE-77 (OS Command Injection) in the API layer of Progress Application Delivery Controller (ADC) products. The 'aclcontrol' command in the management API fails to sanitize user-supplied input before passing it to underlying operating system shell commands. The affected products-LoadMaster (load balancer), ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF-share a common API framework based on version 7.2.x codebase. CPE strings identify these as distinct Progress Software products but with overlapping version ranges, suggesting shared vulnerable code in the ADC platform. The 'VS Administration' permission level indicates elevated administrative access to virtual server configuration, not standard user privileges. The CVSS scope change (S:C) suggests the vulnerability allows breaking out of the intended API/web management context to execute commands at the underlying OS level, potentially impacting other services or containers on the appliance.

RemediationAI

Upgrade all affected Progress ADC products to version 7.2.63.0 or later per Progress advisory at https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876. If immediate patching is not feasible, implement network segmentation to restrict management interface access to dedicated administrative VLANs with strict firewall rules limiting adjacency to only authorized jump hosts or PAM solutions (note: this reduces but does not eliminate risk from compromised admin workstations). Review and minimize assignment of 'VS Administration' permissions using principle of least privilege-audit which accounts possess this role and whether it's necessary for their function. Enable detailed API command logging to detect suspicious 'aclcontrol' usage patterns. Consider placing management interfaces behind multi-factor authentication if not already deployed. These mitigations reduce attack surface but do not address the underlying injection vulnerability; patching to 7.2.63.0 remains the definitive remediation.