Medium severity · published Jan 13, 2026
CVE-2025-13444
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary…
6.8
CVSS
27.2%
EPSS
No
On KEV
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)27.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Connection Manager For Objectscale · Progress
before 7.2.62.2 · source: NVD
EC
Ecs Connection Manager · Progress
before 7.2.62.2 · source: NVD
LO
Loadmaster · Progress
before 7.2.54.16; 7.2.55.0 before 7.2.62.2 · source: NVD
MW
Moveit Web Application Firewall · Progress
7.2.62.1 · source: NVD
MH
Multi-tenant Hypervisor · Progress
before 7.1.35.15 · source: NVD
Affected product
CM
Connection Manager For Objectscale
Progress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13444
Vendor Advisory
https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
Vendor Advisory
https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
Vendor Advisory
https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
Vendor Advisory
https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
More from Connection Manager For Objectscale
9.8
CVE-2026-8037
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
8.4
CVE-2026-59688
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
8.4
CVE-2026-59687
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
8.4
CVE-2026-59686
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
8.0
CVE-2026-59690
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API