LO
Product
LoadMaster
On CISA KEVExploited in the wild
27
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 16Medium 8Low 0
Watch
Add LoadMaster to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8037 In wildKEV | 9.8 | Jun 4 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: before 7.2.54.18; 7.2.55.0 before 7.2.63.2 |
| CVE-2024-1212 In wildKEV | 9.8 | Feb 21 | LoadMaster Pre-Authenticated OS Command Injection Affected: 7.2.48.1 before 7.2.48.10; 7.2.54.0 before 7.2.54.8; 7.2.55.0 before 7.2.59.2 |
| CVE-2024-8755 | 9.8 | Oct 11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affected Versions … Affected: through 7.2.48.12; 7.2.49.0 through 7.2.54.12; 7.2.55.0 before 7.2.61.0 |
| CVE-2025-1758 | 8.8 | Mar 19 | Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy:… Affected: 7.2.40.0 before 7.2.61.1 |
| CVE-2024-2448 | 8.8 | Mar 22 | An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component… Affected: 7.2.49.0 before 7.2.54.9; 7.2.55.0 before 7.2.59.3; 7.1.35.10; 7.2.48.10 |
| CVE-2014-5287 | 8.8 | Jan 8 | A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI) Affected: through 7.1-16 |
| CVE-2026-59688 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality Affected: before 7.2.54.19; 7.2.55.0 before 7.2.63.3 |
| CVE-2026-59687 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface Affected: before 7.2.54.19; 7.2.55.0 before 7.2.63.3 |
| CVE-2026-59686 | 8.4 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface Affected: before 7.2.54.19; 7.2.55.0 before 7.2.63.3 |
| CVE-2026-59690 | 8.0 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API Affected: before 7.2.54.19; 7.2.55.0 before 7.2.63.3 |
| CVE-2026-59689 | 8.0 | Jul 27 | Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root Affected: before 7.2.54.19; 7.2.55.0 before 7.2.63.3 |
| CVE-2024-3544 | 7.5 | May 2 | Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster… Affected: before 7.2.48.11; 7.2.49.0 before 7.2.54.10; 7.2.55.0 before 7.2.59.4 |
| CVE-2024-3543 | 7.5 | May 2 | Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be… Affected: 7.2.49.0 before 7.2.54.10; 7.2.55.0 before 7.2.59.4; 7.2.48.11 |
| CVE-2024-2449 | 7.5 | Mar 22 | A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific… Affected: 7.2.49.0 before 7.2.54.9; 7.2.55.0 before 7.2.59.3; 7.1.35.10; 7.2.48.10 |
| CVE-2026-4048 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: before 7.2.54.17; before 7.2.63.1 |
| CVE-2026-3519 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: before 7.2.54.17; before 7.2.63.1 |
| CVE-2026-3518 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: before 7.2.54.17; before 7.2.63.1 |
| CVE-2026-3517 | 7.2 | Apr 20 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Affected: before 7.2.54.17; before 7.2.63.1 |
| CVE-2024-7591 | 7.2 | Sep 5 | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection Affected: 7.2.40.0 before 7.2.60.1 |
| CVE-2025-13447 | 6.8 | Jan 13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary… Affected: before 7.2.54.16; before 7.2.62.2 |
| CVE-2025-13444 | 6.8 | Jan 13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary… Affected: before 7.2.54.16; 7.2.55.0 before 7.2.62.2 |
| CVE-2024-56135 | 6.8 | Feb 5 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.13; 7.2.55.0 before 7.2.61.0 |
| CVE-2024-56134 | 6.8 | Feb 5 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.13; 7.2.55.0 before 7.2.61.0 |
| CVE-2024-56133 | 6.8 | Feb 5 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.13; 7.2.55.0 before 7.2.61.0 |
| CVE-2024-56132 | 6.8 | Feb 5 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.13; 7.2.55.0 before 7.2.61.0 |
| CVE-2024-56131 | 6.8 | Feb 5 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.13; 7.2.55.0 before 7.2.61.0 |
| CVE-2024-6658 | 6.8 | Sep 12 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected Versions … Affected: through 7.2.48.12; 7.2.49.0 before 7.2.54.12; 7.2.55.0 before 7.2.60.1 |
Showing 27