Login Request a demo
High severity · published Apr 20, 2026
CVE-2026-3517
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVSS
15.5%
EPSS
No
On KEV
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ECS Connections Manager · Progress Software
7.2.49.0 before V7.2.63.0 · source: vendor
LO
LoadMaster · Progress Software
7.1.32.0 before V7.2.63.0 · source: vendor, NVD
MW
MOVEit WAF · Progress Software
7.2.62.0 before V7.2.63.0 · source: vendor
OS
Object Scale Connection Manager · Progress Software
7.2.62.0 before V7.2.63.0 · source: vendor
CM
Connection Manager For Objectscale · Progress
before 7.2.63.1 · source: NVD
EC
Ecs Connection Manager · Progress
before 7.2.63.1 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-319: Progress Software Kemp LoadMaster addcountry Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3517.
CVE-2026-3517
May 21, 2026·Zero Day Initiative
Affected product
EC
ECS Connections Manager
Progress Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3517
Vendor Advisory
https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876
More from ECS Connections Manager
9.8
CVE-2026-8037
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-4048
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-3519
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-3518
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF