CVE-2026-3518: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3518?
CVE-2026-3518 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-3518?
To mitigate CVE-2026-3518, apply the patches provided by Progress for the affected products immediately.
Who is affected by CVE-2026-3518?
CVE-2026-3518 impacts users of Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF.
What type of vulnerability is CVE-2026-3518?
CVE-2026-3518 is an OS Command Injection vulnerability allowing an authenticated attacker to execute arbitrary commands on the server.
What are the potential consequences of CVE-2026-3518?
Exploitation of CVE-2026-3518 can lead to full remote code execution, compromising the confidentiality, integrity, and availability of the system.