CVE-2026-3517: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3517?
CVE-2026-3517 is classified as a high severity OS Command Injection vulnerability that allows remote code execution.
How do I fix CVE-2026-3517?
To mitigate CVE-2026-3517, it is recommended to apply the latest security patches provided by Progress for affected products.
Which products are affected by CVE-2026-3517?
CVE-2026-3517 affects Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF.
Who can exploit the CVE-2026-3517 vulnerability?
An authenticated attacker with 'Geo Administration' privileges can exploit the CVE-2026-3517 vulnerability.
What kind of attack can be performed with CVE-2026-3517?
CVE-2026-3517 allows attackers to perform remote code execution through OS command injection.