What’s Vulnerable › Products

Progress Software LoadMaster vulnerabilities

26 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your Progress Software LoadMaster version is affected

Exploited Progress Software LoadMaster vulnerabilities

• CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability
• CVE-2024-1212 — Progress Kemp LoadMaster OS Command Injection Vulnerability

Latest Progress Software LoadMaster vulnerabilities

• CVE-2026-59690 — Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API (CVSS 8.0)
• CVE-2026-59689 — Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root (CVSS 8.0)
• CVE-2026-59688 — Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality (CVSS 8.4)
• CVE-2026-59687 — Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface (CVSS 8.4)
• CVE-2026-59686 — Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface (CVSS 8.4)
• CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability (CVSS 9.8) — exploited
• CVE-2026-4048 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 7.2)
• CVE-2026-3519 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 7.2)
• CVE-2026-3518 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 7.2)
• CVE-2026-3517 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 7.2)
• CVE-2025-13447 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster (CVSS 6.8)
• CVE-2025-13444 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster (CVSS 6.8)
• CVE-2025-1758 — (CVSS 8.8)
• CVE-2024-56135 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 6.8)
• CVE-2024-56134 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 6.8)
• CVE-2024-56133 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 6.8)
• CVE-2024-56132 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 6.8)
• CVE-2024-56131 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 6.8)
• CVE-2024-8755 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 9.8)
• CVE-2024-6658 — Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection. (CVSS 6.8)
• CVE-2024-3544 — LoadMaster Hardcoded SSH Key (CVSS 7.5)
• CVE-2024-3543 — LoadMaster Reversible Password Encryption Algorithm (CVSS 7.5)
• CVE-2024-2449 — LoadMaster Cross-Site Request Forgery (CSRF) (CVSS 7.5)
• CVE-2024-2448 — LoadMaster Command Injection Vulnerability (CVSS 8.8)
• CVE-2024-1212 — Progress Kemp LoadMaster OS Command Injection Vulnerability (CVSS 9.8) — exploited