EUVD-2026-23857
GHSA-wvwg-7g9q-g3v4
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
AnalysisAI
OS command injection in Progress LoadMaster, MOVEit WAF, ECS Connections Manager, and Object Scale Connection Manager API allows authenticated attackers with 'All' permissions to execute arbitrary commands on appliances via unsanitized input in the 'killsession' API endpoint. CVSS 8.4 (High) reflects adjacent network access vector and high privileges requirement, limiting exploitation to administrators or compromised admin accounts. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF instances and document current versions. Within 7 days: Restrict administrative access to these appliances to only essential personnel, enforce multi-factor authentication on all admin accounts, and implement network segmentation to limit lateral movement from compromised appliances. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today