EUVD-2026-23858
GHSA-g4q4-3mm2-2w69
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
AnalysisAI
Command injection in Progress LoadMaster, ECS Connections Manager, Object Scale Connection Manager, and MOVEit WAF allows authenticated administrators with 'VS Administration' privileges to execute arbitrary operating system commands on the appliance via unsanitized input to the 'aclcontrol' API command. CVSS 8.4 reflects high-privilege requirement but scope change indicates container escape or cross-boundary impact. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify and inventory all affected Progress LoadMaster and ADC deployments; restrict network access to the 'aclcontrol' API endpoint to trusted administrative hosts only using firewall rules; audit administrative account access logs for the 'VS Administration' role. Within 7 days: Disable the 'aclcontrol' API endpoint if operationally feasible; enforce multi-factor authentication for all accounts with VS Administration permissions; conduct a security review of administrative access permissions. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today