CVE-2026-3519
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execu…
Published Apr 20, 2026 · updated Jun 17, 2026 · progress connection manager for objectscale
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2026 · NIST NVD
Detected
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
Jun 17, 2026 · NIST NVD
Updated
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
Affected
- cpe progress/connection manager for objectscaleversion unspecified
- cpe progress/ecs connection managerversion unspecified
- cpe progress/loadmasterversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3519
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3519
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
nvd.nist.gov