CVE-2026-3519
Published: 20 April 2026
Summary
CVE-2026-3519 is a high-severity Command Injection (CWE-77) vulnerability in Progress Loadmaster. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3519 is an OS Command Injection vulnerability (CWE-77) that enables Remote Code Execution in the API of Progress ADC Products. It specifically affects the LoadMaster appliance, where unsanitized input in the 'aclcontrol' command can be exploited by attackers. The vulnerability was published on 2026-04-20 and carries a CVSS v3.1 base score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
An authenticated attacker with “VS Administration” permissions can exploit this vulnerability over an adjacent network with low attack complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary commands on the LoadMaster appliance, potentially leading to full compromise with high impacts on confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in the Progress security advisory at https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876, which addresses this vulnerability alongside CVE-2026-3517, CVE-2026-3518, CVE-2026-4048, and CVE-2026-21876 in LoadMaster.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23858
Vulnerability details
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the exposed API enables exploitation of public-facing application for RCE (T1190), privilege escalation from VS Admin role to full compromise (T1068), and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by requiring validation of unsanitized inputs to the 'aclcontrol' API command.
Remediates the specific vulnerability through timely patching as detailed in the Progress security advisory.
Limits exposure by enforcing least privilege, reducing the number of users with 'VS Administration' permissions required to exploit the API.