{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3519", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-03-04T15:10:17.159Z", "datePublished": "2026-04-20T13:32:50.259Z", "dateUpdated": "2026-04-20T14:06:18.831Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-20T13:32:50.259Z"}, "title": "OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-77", "description": "CWE-77", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88"}]}], "affected": [{"vendor": "Progress Software", "product": "LoadMaster", "versions": [{"status": "affected", "version": "V7.2.45.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "ECS Connections Manager", "versions": [{"status": "affected", "version": "V7.2.49.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "Object Scale Connection Manager", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "MOVEit WAF", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cVS Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command", "supportingMedia": [{"type": "text/html", "base64": false, "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cVS Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command"}]}], "references": [{"url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:57:52.187676Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:06:18.831Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:57:52.187676Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:59:47.729Z"}}], "cna": {"title": "OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "LoadMaster", "versions": [{"status": "affected", "version": "V7.2.45.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "ECS Connections Manager", "versions": [{"status": "affected", "version": "V7.2.49.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "Object Scale Connection Manager", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Progress Software", "product": "MOVEit WAF", "versions": [{"status": "affected", "version": "V7.2.62.0", "lessThan": "V7.2.63.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cVS Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command", "supportingMedia": [{"type": "text/html", "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cVS Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-04-20T13:32:50.259Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3519", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:06:18.831Z", "dateReserved": "2026-03-04T15:10:17.159Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-04-20T13:32:50.259Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with \u201cVS Administration\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command"}], "id": "CVE-2026-3519", "lastModified": "2026-04-20T19:05:30.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "security@progress.com", "type": "Secondary"}]}, "published": "2026-04-20T14:16:19.683", "references": [{"source": "security@progress.com", "url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security@progress.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T17:23:08.469640+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied patch that fixes CVE\u20112026\u20113519 to all affected Progress ADC products.", "Restrict VS Administration permissions to only the users or processes that truly need them, removing unnecessary privileged access.", "Implement input validation for any custom API extensions that invoke the 'aclcontrol' command, ensuring that only allowed, whitelisted arguments are accepted.", "Monitor appliance logs for unexpected or malformed 'aclcontrol' command usage and other indicators of command\u2011injection activity."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected vendor and product families are Progress Software ECS Connections Manager, Progress Software LoadMaster, Progress Software MOVEit WAF, and Progress Software Object Scale Connection Manager. No specific product versions were listed in the advisory; all current deployments of these products should verify whether they contain the patch for CVE\u20112026\u20113519.", "description_and_impact": "A flaw allowing an authenticated attacker with VS Administration permissions to supply unsanitized input to the 'aclcontrol' command in the API of several Progress ADC products leads to OS command injection (CWE\u201177). The injected payload is executed directly on the appliance\u2019s operating system, giving the attacker full remote code execution capabilities. This can compromise confidentiality, integrity, and availability by enabling arbitrary command execution, potential data exfiltration, and denial of service against the appliance.", "risk_and_exploitability": "The CVSS score of 8.4 indicates high severity. Exploitation requires authentication with VS Administration rights, which limits the attack surface to users with that privilege level. The EPSS score is not available and the vulnerability is not listed in CISA\u2019s KEV catalog. Despite the lack of public exploit information, the impact of remote code execution remains substantial for any system that exposes the vulnerable API."}}}}, "created": "2026-04-20T17:30:12.652919+00:00", "updated": "2026-04-20T17:30:12.652929+00:00", "vendors": []}