CVE-2026-3518

Published Apr 20, 2026

Last updated 3 days ago

CVSS high 8.4

Overview

Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command
Source
security@progress.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.4
Impact score
6
Exploitability score
1.7
Vector string
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity
HIGH

Weaknesses

security@progress.com
CWE-77

Social media

Hype score
Not currently trending

References

Sources include official advisories and independent security research.