CVE-2026-3518

high · 8.4

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command

8.4

CVSS

16.9%

EPSS (exploit prob.)

97th

EPSS percentile

2026-04-20

Published

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
progress	connection_manager_for_objectscale	< 7.2.63.1
progress	ecs_connection_manager	< 7.2.63.1
progress	loadmaster	< 7.2.54.17
progress	loadmaster	< 7.2.63.1

Check a specific version with /api/v1/cve/match.

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-3518