CVE-2026-3519

High

Published: 20/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2026-3519 is a remote code execution vulnerability via OS command injection in the API of Progress ADC products. It allows an authenticated attacker with 'VS Administration' permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command.

Risk Assessment

The risk to the organization involves the potential for remote execution of arbitrary commands on the LoadMaster appliance, which could lead to serious security breaches and data loss.

Recommendation

It is recommended to immediately update Progress ADC products to the latest version to patch this vulnerability and review the permissions of users with 'VS Administration' access.

Other vulnerabilities in API w produktach Progress ADC

CVE-2026-3518High
CVE-2026-3518 identifies a vulnerability in the API of Progress ADC products that allows remote code execution via OS command injection. An authenticated attacker with 'All' permissions can exploit unsanitized input in the 'killsession' command to execute arbitrary commands on the LoadMaster appliance.

Original NVD description (English source)

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command