CVE-2026-4048: OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-20 · updated 2026-10-26
Weakness: CWE-77

Description

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.

Affected products

Progress Connection Manager For Objectscale: before 7.2.63.1 — fixed in 7.2.63.1
Progress Software ECS Connection Manager: before 7.2.63.1 — fixed in 7.2.63.1
Progress Software LoadMaster: before 7.2.54.17; before 7.2.63.1 — fixed in 7.2.54.17, 7.2.63.1

How to fix

Upgrade to a fixed version: Progress Connection Manager For Objectscale 7.2.63.1; Progress Software ECS Connection Manager 7.2.63.1; Progress Software LoadMaster 7.2.54.17, 7.2.63.1. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

Get alerted when CVE-2026-4048 or the next vulnerability affects your stack