CVE-2026-4048

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:connection_manager_for_objectscale::::::::
	cpe:2.3:a:progress:ecs_connection_manager::::::::
	cpe:2.3:a:progress:loadmaster:::::ltsf:::*
	cpe:2.3:a:progress:loadmaster:::::ga:::*

History

01 May 2026, 17:34

Type	Values Removed	Values Added
References	~~() https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 -~~	() https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 - Vendor Advisory, Patch
First Time		Progress Progress ecs Connection Manager Progress connection Manager For Objectscale Progress loadmaster
CPE		cpe:2.3:a:progress:connection_manager_for_objectscale:::::::: cpe:2.3:a:progress:ecs_connection_manager:::::::: cpe:2.3:a:progress:loadmaster:::::ltsf:::* cpe:2.3:a:progress:loadmaster:::::ga:::*

20 Apr 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-20 14:16

Updated : 2026-05-01 17:34

NVD link : CVE-2026-4048

Mitre link : CVE-2026-4048

CVE.ORG link : CVE-2026-4048

JSON object : View

Products Affected

progress

ecs_connection_manager
loadmaster
connection_manager_for_objectscale

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-4048", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2026-04-20T14:16:20.700", "references": [{"url": "https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876", "tags": ["Vendor Advisory", "Patch"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with \u201cAll\u201d permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process."}], "lastModified": "2026-05-01T17:34:54.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29595DEA-0B11-4F15-9D98-2FE6B921E1BB", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73724463-A364-43DE-BF05-641226373DD6", "versionEndExcluding": "7.2.63.1"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*", "vulnerable": true, "matchCriteriaId": "AC313444-74D6-491D-B7BA-36BF6382D4FC", "versionEndExcluding": "7.2.54.17"}, {"criteria": "cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*", "vulnerable": true, "matchCriteriaId": "A03DB1D6-4225-406D-8A53-3730266390C1", "versionEndExcluding": "7.2.63.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}