CVE-2026-3518

High

Published: 20/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2026-3518 identifies a vulnerability in the API of Progress ADC products that allows remote code execution via OS command injection. An authenticated attacker with 'All' permissions can exploit unsanitized input in the 'killsession' command to execute arbitrary commands on the LoadMaster appliance.

Risk Assessment

This vulnerability poses a significant risk to organizations as it allows attackers to remotely execute commands on critical devices, potentially leading to data loss or system takeover.

Recommendation

It is recommended to immediately update Progress ADC products to the latest version to patch this vulnerability and review user permissions to restrict access to critical API functions.

Other vulnerabilities in API w produktach Progress ADC

CVE-2026-3519High
CVE-2026-3519 is a remote code execution vulnerability via OS command injection in the API of Progress ADC products. It allows an authenticated attacker with 'VS Administration' permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command.

Original NVD description (English source)

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command