High severity · published Apr 20, 2026
CVE-2026-3519
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVSS
2.1%
EPSS
No
On KEV
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
ECS Connections Manager · Progress Software
V7.2.49.0 before V7.2.63.0 · source: vendor
LO
LoadMaster · Progress Software
V7.2.45.0 before V7.2.63.0 · source: vendor, NVD
MW
MOVEit WAF · Progress Software
V7.2.62.0 before V7.2.63.0 · source: vendor
OS
Object Scale Connection Manager · Progress Software
V7.2.62.0 before V7.2.63.0 · source: vendor
CM
Connection Manager For Objectscale · Progress
before 7.2.63.1 · source: NVD
EC
Ecs Connection Manager · Progress
before 7.2.63.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3519
Patch
https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876
More from ECS Connections Manager
9.8
CVE-2026-8037
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-4048
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-3518
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
7.2
CVE-2026-3517
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF