CVE-2026-3519: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3519?
CVE-2026-3519 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-3519?
To fix CVE-2026-3519, update your Progress ADC products to the latest version that addresses this vulnerability.
What types of products are affected by CVE-2026-3519?
CVE-2026-3519 affects Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF.
Who can exploit CVE-2026-3519?
An authenticated attacker with 'VS Administration' permissions can exploit CVE-2026-3519.
What are the implications of exploiting CVE-2026-3519?
Exploiting CVE-2026-3519 could allow an attacker to execute arbitrary commands on the affected system.