CVE-2026-3517
Published: 20 April 2026
Summary
CVE-2026-3517 is a high-severity Command Injection (CWE-77) vulnerability in Progress Loadmaster. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3517 is an OS command injection vulnerability that enables remote code execution in the API of Progress ADC Products, specifically affecting the LoadMaster appliance. The flaw arises from unsanitized input in the 'addcountry' command, classified under CWE-77. It carries a CVSS v3.1 base score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts with changed scope.
An authenticated attacker possessing “Geo Administration” permissions can exploit this vulnerability over an adjacent network with low complexity and no user interaction required. By injecting malicious commands via the vulnerable 'addcountry' API endpoint, the attacker achieves remote code execution, allowing arbitrary command execution on the LoadMaster appliance.
Progress has published an advisory detailing this and related vulnerabilities (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048, CVE-2026-21876) at https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876. Security practitioners should consult this resource for mitigation guidance and patch information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23856
Vulnerability details
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'addcountry' command
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the API directly enables arbitrary command execution via Unix shell and exploitation for privilege escalation (scope change from geo admin role to full system access).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of unsanitized inputs to the 'addcountry' API command, directly preventing OS command injection exploits.
Mandates identification, reporting, and correction of the specific OS command injection flaw via timely patching of the LoadMaster appliance.
Enforces least privilege to restrict 'Geo Administration' permissions, limiting the accounts able to access and exploit the vulnerable API endpoint.