What is the CVSS score of CVE-2026-4048?

CVE-2026-4048 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Loadmaster are affected by CVE-2026-4048?

Progress LoadMaster and related ADC products contain a command injection vulnerability affecting authenticated administrators that enables arbitrary system-level code execution through malicious WAF…

How to fix or mitigate CVE-2026-4048?

Within 24 hours: Audit and enforce principle of least privilege-restrict 'All' administrative permissions to only essential personnel and implement role-based access controls segregating WAF rule management from system configuration. Within 7 days: Implement application-layer monitoring and logging of all WAF rule file uploads with alerting for suspicious patterns; disable direct file upload capabilities if alternative rule deployment methods exist. Within 30 days: Contact Progress Software for patch timeline and interim build availability; evaluate replacement or segmentation of affected LoadMaster instances; implement file integrity monitoring on uploaded rules.

Loadmaster CVE-2026-4048

EUVD-2026-23859 HIGH

Command Injection (CWE-77)

2026-04-20 ProgressSoftware

GHSA-pwx9-99jm-fx95

File Upload Command Injection RCE Loadmaster Ecs Connections Manager Object Scale Connection Manager Moveit Waf

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 14:33 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 14:15 euvd

EUVD-2026-23859

Analysis Generated

Apr 20, 2026 - 14:15 vuln.today

CVE Published

Apr 20, 2026 - 13:36 nvd

HIGH 8.4

DescriptionCVE.org

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

AnalysisAI

OS command injection in Progress LoadMaster and related ADC products allows authenticated administrators with 'All' permissions to execute arbitrary commands via malicious WAF rule file uploads. The attacker exploits unsanitized input during the file upload process in the web UI. With CVSS 8.4 and scope change to 'Changed', successful exploitation enables complete system compromise beyond the vulnerable component. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. EPSS data not available for risk assessment.

Technical ContextAI

This vulnerability affects Progress Software's Application Delivery Controller (ADC) suite, specifically LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF. The flaw is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the application fails to sanitize user-controlled input before passing it to operating system command interpreters. The vulnerable code path exists in the WAF rule file upload functionality within the web management UI. When custom WAF rules are uploaded, the appliance processes the file contents without proper input validation, allowing shell metacharacters or command sequences to be interpreted by the underlying OS. The CVSS vector indicates Adjacent Network attack vector (AV:A), meaning the attacker must be on the same network segment as the management interface, though this is often achievable in enterprise environments through VPN access or internal network positioning.

RemediationAI

Apply security updates per Progress Software advisory at https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876. Exact patched versions are not specified in available data - consult the vendor advisory directly for release numbers and upgrade procedures. If immediate patching is not feasible, implement compensating controls: (1) Restrict access to the LoadMaster management interface to dedicated admin jump hosts or bastion servers on isolated VLANs, reducing the adjacent network attack surface. (2) Implement principle of least privilege by auditing administrator accounts and removing 'All' permissions where not strictly required, granting only specific functional permissions. (3) Enable detailed audit logging for all WAF rule file upload operations and monitor for anomalous file content patterns or unexpected command sequences. (4) If WAF custom rule uploads are not operationally required, disable this functionality through appliance hardening policies. Note that disabling custom WAF rules may impact security posture if legitimate custom rules are in production. (5) Deploy network segmentation to prevent lateral movement from ADC appliances to backend systems, limiting Changed Scope impact even if compromise occurs.